GCP Professional Cloud Security Engineer Practice Question

An online banking platform subject to GDPR must process personal data exclusively within Germany. Their risk-analytics application requires 64 vCPUs, 512 GB of RAM, and must run on Google Confidential VMs for in-memory encryption. As the security engineer, which Compute Engine deployment best satisfies both the compliance mandate and the technical requirements while keeping management effort low?

Deploy the service on App Engine flexible environment in the europe-west EU multi-region and encrypt data at rest with customer-managed keys.
Provision a GKE Autopilot cluster in europe-west3 with shielded nodes and auto-provisioned node pools.
Create a Compute Engine n2-highmem-64 Confidential VM in europe-west1 and protect the project with VPC Service Controls to prevent data egress.
Create a Compute Engine n2d-highmem-64 Confidential VM in europe-west3 and enforce the gcp.resourceLocations organization policy to restrict all projects to that region.

Report Issue

Answer Description

Confidential VMs are only supported on N2D and C2D machine types. An n2d-highmem-64 instance provides 64 vCPUs and 512 GB of RAM and can run as a Confidential VM. Deploying it in europe-west3 (Frankfurt) ensures that processing remains within Germany, meeting the GDPR data-residency requirement. Adding the gcp.resourceLocations organization policy locks all resources to that region, reducing the risk of accidental deployment elsewhere and limiting ongoing administrative work.

The second option chooses europe-west1 (Belgium), so data could leave Germany and violate the residency mandate. The third option uses App Engine flexible in the EU multi-region, which replicates workloads across multiple EU countries and does not support Confidential VMs. The fourth option relies on GKE Autopilot, which currently does not offer Confidential VM nodes, so it cannot meet the in-memory encryption requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.