Your organization has an internet-facing application behind a load balancer. Your regulators require end-to-end encryption of user login credentials. You must implement this requirement. What should…

Question

Options

• AGenerate a symmetric key with Cloud KMS. Encrypt client-side user credentials by using the
• BConcatenate the credential with a timestamp. Submit the timestamp and hashed value of
• CDeploy the TLS certificate at Google Cloud Global HTTPs Load Balancer, and submit the user
• DGenerate an asymmetric key with Cloud KMS. Encrypt client-side user credentials using the

• A
  3% (1)
• B
  13% (4)
• C
  3% (1)
• D
  81% (25)

Explanation

Option D is correct because asymmetric encryption allows the public key to be distributed to the client for encrypting credentials before they leave the browser, while the private key remains exclusively on the application server - meaning the load balancer never sees plaintext credentials, satisfying true end-to-end encryption.

Why the distractors fail:

• Option A (symmetric key): A symmetric key must be shared between encryptor and decryptor. Distributing it to clients exposes it, and any intermediary with the key (including the load balancer) can decrypt the data - not end-to-end.
• Option B (hash + timestamp): Hashing is one-way and is not encryption. Regulators requiring "encryption" of credentials cannot be satisfied by a hash - the original value cannot be recovered or verified server-side as an encrypted payload.
• Option C (TLS at load balancer): TLS termination at the load balancer means credentials are decrypted at the load balancer, then forwarded in plaintext (or re-encrypted) to the backend. This is transport encryption only - the load balancer is a decryption point, violating the end-to-end requirement.

Memory tip: When you see "end-to-end" + "load balancer in the middle," ask yourself who can decrypt. Only asymmetric encryption lets you give everyone the public key while keeping the private key sealed at the destination - the load balancer becomes a blind passthrough.

No community discussion yet for this question.