Home Microsoft Exams Google Cloud Exams

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Terms Privacy Cookies About

© 2026 StudyCerts. All rights reserved.

Loading page

Confidential Vm Tee Memory Encryption | Professional Cloud Security Engineer | StudyCerts

Home
Google Cloud Exams
Professional Cloud Security Engineer
Enabling Confidential Computing.
A financial analytics firm is deploying a multi-party comput…

Professional Cloud Security Engineer

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Description
Sample Question
Free Trial
Practice Test

Advanced

Prepare and test your skills

Track Readiness

Description
Sample Question
Free Trial
Practice Test

Confidential Vm Tee Memory Encryption

Section: Enabling Confidential Computing.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial analytics firm is deploying a multi-party computation application on Google Cloud Compute Engine to process highly sensitive customer credit records. The compliance team mandates zero-trust data protection specifically for data in use, requiring that plaintext memory contents remain cryptographically shielded from unauthorized inspection or tampering by co-located tenant workloads, the host hypervisor, and Google infrastructure administrators.

Which hardware-based Trusted Execution Environment (TEE) mechanism directly fulfills these isolation and runtime memory protection requirements?

Sole-tenant nodes combined with nested paging virtualization and hierarchical VPC firewall policies to isolate compute execution

Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS to protect persistent disks and suspended instance memory snapshots

Shielded VM Virtual Trusted Platform Module (vTPM) and Secure Boot validation measuring guest kernel integrity during the boot phase

AMD Secure Encrypted Virtualization (SEV) generating ephemeral, hardware-managed AES keys within the processor to encrypt VM memory in RAM

Explanations

Related questions

Keep the momentum going with these hand-picked practice scenarios

AdvancedProfessional Cloud Security Engineer

Two independent healthcare institutions want to collaborate by training a shared predictive machine learning model using their respective proprietary clinical datasets. The collaboration has the following strict security and governance requirements: Neither organization is permitted to expose raw data or cryptographic decryption keys to the other party. The infrastructure administrator executing the workload must not be able to view data in use in memory, access the underlying operating system, or extract intermediate computation states. Decryption keys stored in Cloud Key Management Service (Cloud KMS) must be released dynamically only after cryptographically verifying the identity, boot measurements, and container image digest of the executing workload. Which Google Cloud Confidential Computing solution should be implemented to support this multi-party collaboration?

Enabling Confidential Computing.

AdvancedProfessional Cloud Security Engineer

A multinational financial services institution is migrating a mission-critical payment processing system to Google Cloud. The compliance and security teams mandate a comprehensive, end-to-end data protection strategy that enforces strict data confidentiality across all stages of the data lifecycle: Data in use: Processing in memory must be cryptographically isolated from the underlying hypervisor, host OS, and cloud operator operations via hardware-rooted Trusted Execution Environments (TEEs). Data at rest: All databases, object stores, and persistent disk volumes must be encrypted using customer-controlled keys with automated rotation and hardware security module backing. Data in transit: All communication channels between external clients, ingestion endpoints, and backend services must strictly enforce modern cryptographic ciphers and protocols. Which architecture meets all of these end-to-end data protection requirements?

AdvancedProfessional Cloud Security Engineer

An enterprise is migrating general application workloads, secrets, and log data to Google Cloud services such as Cloud Storage and Secret Manager. The enterprise's security policy mandates that all data at rest must satisfy NIST-approved baseline encryption standards, while the operations team wants to avoid the administrative burden of provisioning and managing custom key infrastructure. Which statement accurately evaluates the underlying architecture, baseline security capabilities, and operational limitations of Google default encryption (Google-managed encryption keys)?

AdvancedProfessional Cloud Security Engineer

An enterprise organization is establishing perimeter security and API governance across its Google Cloud resource hierarchy. A security engineer must implement controls to meet the following requirements: Requirement 1: Prevent project owners in the Development folder from activating or consuming any unapproved Google Cloud APIs, ensuring only an explicit allowlist of authorized services (such as Compute Engine and Cloud Storage) can be used. Requirement 2: Secure external API keys used by backend web servers so that the keys can only be used from authorized server IP addresses and can only invoke the designated backend service API. Which combination of controls should the security engineer implement to satisfy these requirements?

AdvancedProfessional Cloud Security Engineer

A multinational financial services enterprise is preparing for an annual regulatory compliance audit. The security engineering team needs to determine every principal—including individual users, nested Google Groups, and service accounts—that possesses effective storage.objects.get or storage.objects.setIamPolicy permissions on specific sensitive Cloud Storage buckets across multiple production projects. Access to these buckets may be granted directly at the bucket level, inherited from parent folders or the organization root, or granted indirectly through custom IAM roles and group memberships. Which approach should the security engineering team use to evaluate these effective access paths with minimal operational overhead?

FundamentalAssociate Data Practitioner

An organization is designing a data pipeline to process marketing analytics data collected from external advertising platforms. The analytics team wants to load the raw data directly into the cloud data warehouse first without pre-processing it in transit, and then use SQL scripts and Dataform to clean, model, and aggregate the data inside the warehouse. Which data integration pattern and Google Cloud service strategy should the team implement?

Want more questions like this?

Get a free certification question every week.

Are you ready for the Professional Cloud Security Engineer?

50 questions in the full practice test

No account required · Instant results

More Enabling Confidential Computing. practice questions

Get a free certification question with a full explanation every week.

Professional Cloud Security Engineer

Provider: Google Cloud
Passing score: 70%
Questions: 50
Duration: 90 minutes

Other sections in this exam

Configuring access
Securing communications and establishing boundary protection
Ensuring data protection
Managing operations
Supporting compliance requirements

Ask Scout

Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.

Enabling Confidential Computing.

Identifying use cases for Google default encryption, customer-managed encryption keys (CMEK), and Cloud External Key Manager (EKM).

Continually monitoring and restricting configured APIs.

Applying Policy Intelligence.

Evaluate use cases for ELT and ETL