A financial organization is establishing baseline compute and workload security controls on Google Cloud to comply with strict regulatory mandates. The architecture includes workloads running on Compute Engine instances and Google Kubernetes Engine (GKE) clusters. The regulatory framework requires the following technical safeguards: Data-in-use protection: Sensitive data must remain encrypted in host memory during execution. Boot integrity: Nodes and virtual machines must detect and prevent boot-level rootkits and kernel tampering. Workload supply chain integrity: Only cryptographically verified and attested container images can be deployed to production clusters. Host hardening and exposure reduction: Node operating systems must have a minimal attack surface and avoid direct public internet exposure. Which combination of Google Cloud security controls and configurations should the organization implement to satisfy these compliance requirements?

Enable Confidential VMs and Confidential GKE Nodes; activate Shielded VM features (Secure Boot, vTPM, and Integrity Monitoring); enforce Binary Authorization deploy policies; and deploy private GKE clusters utilizing Container-Optimized OS (COS).: ### What the Combined Solution Is This architecture combines Google Cloud's core compute hardening and isolation services: **Confidential Computing**, **Shielded VMs/GKE Nodes**, **Binary Authorization**, and **Container-Optimized OS (COS)** in a private cluster topology to establish an end-to-end trusted computing and workload isolation baseline. ### How It Meets the Requirements - **Data-in-use protection**: **Confidential VMs** and **Confidential GKE Nodes** leverage hardware-based memory encryption (such as AMD Secure Encrypted Virtualization [SEV]) to encrypt data in RAM during processing, ensuring that hypervisors, host OS components, or co-located processes cannot read unencrypted data in memory. - **Boot integrity**: **Shielded VM** features—specifically **Secure Boot**, **Virtual Trusted Platform Module (vTPM)**, and **Integrity Monitoring**—cryptographically verify firmware and kernel components against known baselines during startup and alert on any kernel or driver tampering. - **Workload supply chain integrity**: **Binary Authorization** acts as a Kubernetes admission controller that intercepts pod deployment requests and validates cryptographic digital signatures (attestations) against defined enterprise signature policies before allowing containers to run. - **Host hardening and exposure reduction**: **Container-Optimized OS (COS)** provides an immutable, minimal, security-enhanced Linux OS optimized for container runtimes, while **private GKE clusters** prevent worker nodes from having public IP addresses, eliminating direct internet-based attack vectors such as SSH exploits. ### Key Advantages - **Zero-trust host model**: Encrypts memory payloads while preserving performance without requiring code changes to applications. - **Supply chain governance**: Guarantees that only CI/CD-built and vulnerability-checked container images matching required attestations reach production. - **Tamper detection**: Automatically generates audit logs and alerts if host boot sequence hashes deviate from the signed baseline. - **Reduced attack surface**: Minimizes installed packages and open ports on host nodes, mitigating vulnerabilities like CVE-2024-6387 in exposed administrative services. ### Why This Is Optimal This solution comprehensively addresses each technical layer—hardware memory encryption, boot-level verification, deployment-time image attestation, and hardened network isolation—without creating architectural gaps or relying on controls limited to data-at-rest.

Compute Gke Compliance Workload Isolation Baseline | Professional Cloud Security Engineer

Compute Gke Compliance Workload Isolation Baseline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial organization is establishing baseline compute and workload security controls on Google Cloud to comply with strict regulatory mandates. The architecture includes workloads running on Compute Engine instances and Google Kubernetes Engine (GKE) clusters.

The regulatory framework requires the following technical safeguards:

Data-in-use protection: Sensitive data must remain encrypted in host memory during execution.
Boot integrity: Nodes and virtual machines must detect and prevent boot-level rootkits and kernel tampering.
Workload supply chain integrity: Only cryptographically verified and attested container images can be deployed to production clusters.
Host hardening and exposure reduction: Node operating systems must have a minimal attack surface and avoid direct public internet exposure.

Which combination of Google Cloud security controls and configurations should the organization implement to satisfy these compliance requirements?

Implement Google Cloud Armor security policies; deploy Web Security Scanner for automated DAST testing; enable Container Threat Detection in Security Command Center; and utilize standard Ubuntu-based VM images.

Configure Customer-Managed Encryption Keys (CMEK) with Cloud KMS across all Persistent Disks; enable VPC Service Controls perimeters; apply GKE Sandbox (gVisor) on all nodes; and configure Cloud Armor edge policies.

Enable Artifact Analysis automatic vulnerability scanning; deploy Cloud HSM to store master encryption keys; enforce Workload Identity Federation on GKE; and attach public IPs with default firewall rules.

Enable Confidential VMs and Confidential GKE Nodes; activate Shielded VM features (Secure Boot, vTPM, and Integrity Monitoring); enforce Binary Authorization deploy policies; and deploy private GKE clusters utilizing Container-Optimized OS (COS).

Professional Cloud Security Engineer

Compute Gke Compliance Workload Isolation Baseline

Related questions