Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ256

Ensuring data protection

Your organization needs to store highly sensitive data in Google Cloud. You must design a solution that delivers the highest level of security and control. What should you do?

  • A Use Cloud Storage with customer-supplied encryption keys (CSEK), VPC Service Controls for network isolation, and Cloud DLP for data inspection.
  • B Use Cloud Storage with customer-managed encryption keys (CMEK), Cloud DLP for data classification, and Secret Manager for storing API access tokens.
  • C Use Cloud Storage with client-side encryption, Cloud KMS for key management, and Cloud HSM for cryptographic operations.
  • D Use Cloud Storage with server-side encryption, BigQuery with column-level encryption, and IAM roles for access control.
Explanation

Client-side encryption protects data before it is sent to Cloud Storage and gives the customer full control of encryption and decryption. Cloud KMS centrally manages the keys, while Cloud HSM performs cryptographic operations with HSM-protected keys, providing hardware-backed protection for highly sensitive data.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!