GCP Professional Cloud Security Engineer Practice Question

Confidential Space creates a hardware-based trusted execution environment (TEE) where containerized workloads run with memory encrypted by the CPU and are remotely attested before execution. This prevents Google, the host OS, and even collaborating parties from viewing plaintext data while still allowing standard container images to be executed, so each organization can contribute data and code without exposing sensitive information. CMEK, VPC Service Controls, and object lifecycle policies protect data at rest or control network egress but do not encrypt data while it is being processed, so they cannot guarantee confidentiality during joint in-memory analytics.