Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your healthcare analytics platform runs on several Compute Engine VMs in us-central1. Each VM uses a zonal Persistent Disk that was created with Google-managed default encryption. New compliance requirements say you must control the encryption keys so that deleting a key renders its data permanently unreadable. You must migrate to customer-managed encryption keys (CMEK) with no data leaving us-central1 and with at most one reboot per VM. What should you do?

  • Create a symmetric Cloud KMS key in a key ring located in us-central1 and grant the Compute Engine service account the CryptoKey Encrypter/Decrypter role. Snapshot each existing disk, create a new disk from the snapshot specifying the CMEK key, attach it to the VM, and reboot once.

  • Enable Confidential VMs on every instance; this automatically converts attached Persistent Disks to CMEK without requiring snapshots or reboots.

  • Create a symmetric Cloud KMS key in location "global", grant the project Roles/Editor to that key, and update each existing Persistent Disk in place with gcloud compute disks update --csek-key-file.

  • Create a Cloud HSM key in us-central1, export every disk to Cloud Storage, import each as an image encrypted with the key, create new disks from the images, and rebuild the VMs from scratch.

GCP Professional Cloud Security Engineer
Ensuring data protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot