An organization is deploying a data analytics pipeline on Google Cloud and needs to define security controls for different stages of the data lifecycle. The security architecture requires two fundamental protections: Protect data payloads from interception, eavesdropping, and tampering while moving across external networks and Google Cloud services. Protect stored persistent files and database records from unauthorized access if physical storage media or underlying disks are accessed. Which combination of mechanisms correctly distinguishes between encryption in transit and encryption at rest to satisfy these requirements?

Apply Transport Layer Security (TLS/SSL) for encryption in transit, and apply server-side disk-level encryption for encryption at rest.: ### **What TLS and Disk-Level Encryption Are:** **Transport Layer Security (TLS)** and **server-side disk-level encryption** represent two complementary layers of data protection in Google Cloud. **Encryption in transit** protects network packets while they are being transmitted between a client and Google Cloud (or between Google Cloud services) by establishing an encrypted communication channel. **Encryption at rest** protects stored data by transforming readable plaintext into ciphertext before it is committed to non-volatile physical storage devices such as persistent disks, solid-state drives (SSDs), or object storage buckets. ### **How this meets the requirements:** - **Protects data moving across networks (✓):** Using **TLS/SSL protocols** encrypts network traffic at the transport layer, preventing eavesdropping, man-in-the-middle attacks, and unauthorized payload sniffing while data travels across network boundaries. - **Protects stored data on physical media (✓):** Applying **server-side disk encryption** (using Google-default keys or **Customer-Managed Encryption Keys (CMEK)**) ensures that stored blocks on **VM persistent disks** and storage buckets cannot be read if physical disks are decommissioned, extracted, or accessed without appropriate cryptographic keys. ### **Key advantages and capabilities:** - **Automatic default coverage:** Google Cloud encrypts all customer data **at rest by default** using AES-256 without requiring manual user intervention. - **Robust transport security:** All external traffic to Google Cloud APIs is secured by default using industry-standard **TLS 1.2 or TLS 1.3**. - **Defense-in-depth architecture:** Combines network boundary protection with low-level storage protection to safeguard data at every phase of the lifecycle. - **Granular key management:** Allows organizations to maintain control over encryption keys using **Cloud KMS** (Key Management Service) when compliance requires customer-managed keys. ### **Why this is optimal:** This configuration aligns precisely with Google Cloud security best practices by mapping each protection state (data in transit vs. data at rest) to its dedicated cryptographic protocol and storage mechanism, ensuring complete end-to-end security.

StudyCerts

Encryption Transit Rest Lifecycle Mechanisms | Unlock the power of your data in the cloud! Get hands-on with Google Cloud's core data services like BigQuery and Looker to validate your practical skills in data ingestion, analysis, and management, and earn your Associate Data Practitioner certification! | StudyCerts

Associate Data Practitioner

Unlock the power of your data in the cloud! Get hands-on with Google Cloud's core data services like BigQuery and Looker to validate your practical skills in data ingestion, analysis, and management, and earn your Associate Data Practitioner certification!

Fundamental

Prepare and test your skills

Track Readiness

Set Exam Goal

Fundamental

Prepare and test your skills

Track Readiness

Set Exam Goal

Encryption Transit Rest Lifecycle Mechanisms

Section: Identify the difference between encryption in transit and encryption at rest

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization is deploying a data analytics pipeline on Google Cloud and needs to define security controls for different stages of the data lifecycle. The security architecture requires two fundamental protections:

Protect data payloads from interception, eavesdropping, and tampering while moving across external networks and Google Cloud services.
Protect stored persistent files and database records from unauthorized access if physical storage media or underlying disks are accessed.

Which combination of mechanisms correctly distinguishes between encryption in transit and encryption at rest to satisfy these requirements?

Apply Transport Layer Security (TLS/SSL) for encryption in transit, and apply server-side disk-level encryption for encryption at rest.

Apply server-side disk-level encryption for encryption in transit, and apply Transport Layer Security (TLS/SSL) for encryption at rest.

Apply Customer-Managed Encryption Keys (CMEK) over TLS for encryption in transit, and apply unencrypted temporary local storage for encryption at rest.

Apply Secure Shell (SSH) port forwarding exclusively for encryption at rest, and apply database table partitioning for encryption in transit.

Associate Data Practitioner

Encryption Transit Rest Lifecycle Mechanisms

Related questions