CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Exam Question Walkthrough: Google Professional Data Engineer - Data Encryption
Explore this Google Professional Data Engineer exam question about data encryption and learn how to choose the right option.
A financial services company is storing sensitive customer data in Google Cloud Storage. Due to regulatory compliance requirements, they need to ensure that the data is encrypted both at rest and in transit. Which Google Cloud feature should they use to meet these requirements?
Options:
- A: Cloud Key Management Service (KMS) for encryption at rest
- B: Customer-managed encryption keys (CMEK) for encryption at rest
- C: Cloud Storage Transfer Service for data in transit
- D: VPC Service Controls for securing data in transit
Think before you scroll
Consider the specific requirements of data encryption in both storage and transit. Focus on features that allow for both types of encryption while adhering to compliance standards.
The answer
The correct option is B: Customer-managed encryption keys (CMEK) for encryption at rest. CMEK allows users to manage their own encryption keys within Google Cloud KMS, ensuring compliance with regulatory requirements.
Why the other options lose
- A: Cloud Key Management Service (KMS) for encryption at rest: While KMS is a useful service, it does not provide the level of control over encryption keys that CMEK does. This option does not meet the requirement for regulatory compliance.
- C: Cloud Storage Transfer Service for data in transit: This service is focused on transferring data rather than encrypting it during transit. It does not address the encryption needs for stored data at rest.
- D: VPC Service Controls for securing data in transit: VPC Service Controls enhance security by defining service perimeters. However, they do not specifically handle encryption of data in transit, which is needed for this scenario.
The concept behind it
Understanding encryption in cloud environments is critical. Encryption at rest protects stored data, while encryption in transit secures data moving between services. Customer-managed encryption keys (CMEK) empower users with control over their encryption, which is essential for regulatory compliance.
Exam trap to remember
Remember, the two-question rule: if a question focuses on regulatory compliance and encryption, prioritize options that provide management control over encryption keys.