Your organization operates in a highly regulated environment and has a stringent set of compliance requirements for protecting customer data. You must encrypt data while in use to meet regulations…

Question

Options

• AEnable the use of customer-supplied encryption keys (CSEK) keys in the Google Compute
• BEstablish a trusted execution environment with a Confidential VM.
• CUse a Shielded VM to ensure a secure boot with integrity monitoring for the application
• DUse customer-managed encryption keys (CMEK) and Cloud KSM to enable your organization to

• A
  5% (2)
• B
  76% (29)
• C
  3% (1)
• D
  16% (6)

Explanation

A Confidential VM establishes a Trusted Execution Environment (TEE) that uses hardware-based memory encryption (AMD SEV or Intel TDX) to encrypt data while it is actively in use - i.e., while being processed in memory. This directly satisfies the requirement to encrypt data while in use. Options A (CSEK) and D (CMEK with Cloud KMS) are both at-rest encryption mechanisms; they protect data stored on disk but do not protect data once it is loaded into memory for processing. Option C (Shielded VM) provides secure boot and integrity monitoring to verify the VM has not been tampered with, but it does not encrypt in-memory data. Only Confidential VM addresses the 'data in use' encryption requirement.

No community discussion yet for this question.