QuestionQ155
Ensuring data protectionA financial-modeling application is already deployed on Google Cloud and processes large volumes of sensitive customer financial data. Its code is old and not well understood by the current software engineers. Recent threat-modeling exercises identified a potential risk of sophisticated side-channel attacks against the application while it runs.
You need to further harden the Google Cloud solution to mitigate this side-channel-attack risk, provide maximum protection for the confidentiality of financial data during processing, and minimize application issues. What should you do?
- A Enforce stricter access controls for Compute Engine instances by using service accounts, least privilege IAM policies, and limit network access.
- B Implement a runtime library designed to introduce noise and timing variations into the application's execution which will disrupt side-channel attack.
- C Migrate the application to Confidential VMs to provide hardware-level encryption of memory and protect sensitive data during processing.
- D Utilize customer-managed encryption keys (CMEK) to ensure complete control over the encryption process.
Community Discussion