You manage a mission-critical workload for your organization, which is in a highly regulated industry. The workload uses Compute Engine VMs to analyze and process the sensitive data after it is…

Question

Options

• AConfigure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded
• BConfigure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to
• CCreate Confidential VMs to access the sensitive data.
• DMigrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
• ECreate a VPC Service Controls service perimeter across your existing Compute Engine VMs and

• A
  7% (2)
• B
  50% (15)
• D
  13% (4)
• E
  30% (9)

Explanation

Cloud External Key Manager (EKM) satisfies the requirements to manage DEKs outside Google's boundary and through a third-party key provider - unlike CMEK (option A), which stores keys within Google Cloud KMS and therefore fails both the "outside Google boundary" and "third-party control" requirements. Confidential VMs (option C) use AMD SEV to encrypt VM memory at runtime, directly satisfying the in-use encryption requirement; critically, Confidential Computing must be enabled at VM creation time - you cannot migrate an existing standard VM into a Confidential VM (making option D technically impossible in GCP, hence C is correct over D). Option E (VPC Service Controls) is a network-level data exfiltration guard, not an encryption mechanism, so it does not address any of the stated encryption requirements.

Memory tip: Think "External = Exit Google" (EKM keys live outside GCP), and "Confidential = Create new" (Confidential VMs must be born confidential, never converted).

No community discussion yet for this question.