GCP Professional Cloud Architect Practice Question

Your healthcare analytics team is moving a new application to Google Cloud. Patient records will arrive via HTTPS to a private GKE cluster, be archived in Cloud Storage, and later analyzed in BigQuery. No customer-managed or customer-supplied encryption keys, VPNs, or additional network controls have been planned. During a security review an external auditor asks how these data will be protected while stored and while travelling between Google services and data centers under this default design. Which statement accurately addresses the auditor's concern?

Cloud Storage provides default encryption, but BigQuery tables are left unencrypted unless you explicitly enable customer-managed encryption keys for every dataset.
Google Cloud encrypts all customer data at rest with Google-managed AES keys and secures data in transit on both public TLS connections and Google's internal backbone by default, so no extra configuration is required for baseline encryption.
Customer data is stored in plaintext unless Cloud KMS with customer-supplied keys is enabled, and network traffic remains unencrypted unless a Cloud VPN tunnel is configured.
Traffic inside individual Google data centers is encrypted, but inter-region traffic travels unencrypted unless you create Private Service Connect endpoints and use Dedicated Interconnect.

Report Issue

Answer Description

Google Cloud automatically applies multiple, transparent layers of encryption without requiring any customer action. All data written to Cloud Storage, BigQuery, and other persistent storage systems is encrypted at rest with Google-managed keys (currently using AES-256 or AES-128 data-encryption keys wrapped by regularly rotated key-encryption keys). For data in transit, Google enforces encryption on traffic between customers and Google services using TLS and also encrypts all traffic between Google data centers and within Google's private backbone. Therefore, baseline encryption objectives are met even if the project team does not configure CMEK/CSEK, VPNs, or additional network controls. The alternative statements are incorrect because: they claim data is stored in plaintext (it is not), state that BigQuery is unencrypted by default (it is encrypted), or assert that inter-region traffic on Google's backbone is unencrypted (it is also encrypted by default).

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.