Your organization's financial modeling application is already deployed on Google Cloud. The application processes large amounts of sensitive customer financial data. Application code is old and…

Question

Options

• AEnforce stricter access controls for Compute Engine instances by using service accounts, least
• BImplement a runtime library designed to introduce noise and timing variations into the
• CMigrate the application to Confidential VMs to provide hardware-level encryption of memory and
• DUtilize customer-managed encryption keys (CMEK) to ensure complete control over the

• A
  34% (19)
• B
  14% (8)
• C
  43% (24)
• D
  9% (5)

Explanation

Side-channel attacks target data in use - information leaked through observable system behavior such as memory access patterns, cache timing, or CPU microarchitectural state while code is executing. Confidential VMs use hardware-based memory encryption (e.g., AMD SEV) to encrypt RAM contents at the hardware level, ensuring that even an attacker with access to the physical host or hypervisor cannot read plaintext data from memory. This directly mitigates side-channel attacks targeting in-use data. Critically, it requires no changes to application code - important given the poorly-understood legacy codebase. CMEK (option D) only protects data at rest and in transit. Stricter IAM (option A) and a runtime noise library (option B) either don't address the attack vector or risk breaking a fragile legacy application.

No community discussion yet for this question.