Home Microsoft Exams Google Cloud Exams

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Terms Privacy Cookies About Pricing

© 2026 StudyCerts. All rights reserved.

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider.

Loading page

Home
Google Cloud Exams
Professional Cloud Security Engineer
Applying encryption methods to various use cases.
A security engineer is configuring end-to-end encryption in …

Professional Cloud Security Engineer

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Cloud Sql Postgres Shared Ca Tls Verification

Section: Applying encryption methods to various use cases.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

...

...

...

...

...

Explanations

...

View source documentation

Related questions

Keep the momentum going with these hand-picked practice scenarios

AdvancedProfessional Cloud Security Engineer

A financial enterprise is designing an application-layer data protection pipeline to process customer transaction records before storing them in a shared data repository. The security team established the following technical requirements: Sensitive 10-digit customer account numbers and telephone numbers must be encrypted using Format-Preserving Encryption (FPE) in FFX mode to maintain exact numeric lengths and data types for downstream database compatibility. The transformation must support two-way reversibility (re-identification) by authorized security auditing services. The underlying symmetric data encryption key (DEK) used by the encryption engine must be protected using envelope encryption and wrapped by a Cloud Key Management Service (Cloud KMS) Key Encryption Key (KEK), preventing plaintext DEK exposure in application configurations. Transformed values must include surrogate metadata tags so automated re-identification jobs can identify and reverse the specific field transformation. Which Sensitive Data Protection (Cloud DLP) configuration meets these requirements?

Applying encryption methods to various use cases.

AdvancedProfessional Cloud Security Engineer

A financial enterprise is implementing an organizational security architecture in Google Cloud to meet strict compliance mandates for data at rest across regional workloads. The security team has established the following requirements: All newly created storage and database resources must strictly use Customer-Managed Encryption Keys (CMEK) rather than Google default encryption. Encryption keys must be centrally managed in dedicated security projects, preventing workload project teams from creating or selecting keys in unauthorized projects. Workload service identities must be granted only the minimum necessary cryptographic permissions required for envelope encryption. Which combination of organization policies and Identity and Access Management (IAM) configurations should the security engineer implement?

Applying encryption methods to various use cases.

AdvancedProfessional Cloud Security Engineer

A security engineer is designing a Customer-Managed Encryption Key (CMEK) lifecycle strategy for sensitive enterprise workloads hosted in Google Cloud. Company security compliance mandates that encryption keys must automatically rotate every 90 days. The engineer must configure the CMEK keys and dependent cloud resources so that: Key rotation occurs automatically on schedule without manual operational intervention. New data writes are automatically protected with the newest key version. Existing historical data remains decryptable and accessible without requiring immediate manual re-encryption or updating resource configurations. Which configuration strategy should the engineer implement?

Creating and managing encryption keys for CMEK and EKM (e.g., key rotation and revocation, key import).

AdvancedProfessional Cloud Security Engineer

A financial enterprise is designing a network architecture on Google Cloud to adhere to strict regulatory compliance standards for sensitive data workloads. The organization must meet the following security requirements: Prevent data exfiltration from Google-managed services (such as Cloud Storage and BigQuery) to unauthorized external storage resources or accounts. Ensure internal virtual machines (VMs) without external IP addresses access supported Google APIs exclusively over a private Google routing path. Restrict inbound HTTP(S) traffic to public-facing applications at the network edge based on source CIDR blocks and protect backends from direct internet exposure. Allow secure administrative SSH access to internal VMs without assigning public IP addresses or exposing port 22 directly to the public internet. Which combination of Google Cloud architectural controls should the enterprise implement?

Determining technical needs relative to compute, data, network, and storage.

AdvancedProfessional Cloud Security Engineer

An enterprise has deployed Cloud Next-Generation Firewall (Cloud NGFW) Enterprise with Intrusion Prevention Service (IPS) profiles and TLS inspection to secure sensitive workloads within a VPC network. The Security Operations Center (SOC) is investigating suspicious outbound Layer 7 application traffic suspected of being command-and-control (C2) communication. The security team must: Verify whether Cloud NGFW detected the threat signature and whether the policy actively blocked or merely alerted on the traffic. Identify the Layer 7 application name, threat ID, and threat severity directly from the log records. Stream high-severity threat events in real time to the enterprise SIEM for automated incident triage without losing critical security signals. Which logging analysis and integration strategy should the security engineer implement?

Setting up application layer inspection on Cloud NGFW (e.g., layer 7).

IntermediateProfessional Cloud Architect

An enterprise runs a nightly data transformation workload on Google Cloud. The architecture must satisfy the following technical and financial constraints: The nightly batch pipeline is stateless, highly fault-tolerant, and checkpoints state to object storage every 10 minutes. Compute costs for the 6-hour overnight processing window must be minimized as aggressively as possible. The transformed final reports must be actively queried throughout the business day by international business intelligence teams located in North America and Europe. The storage layer hosting the active daily reports requires high availability with a 99.99% availability Service Level Agreement (SLA). Which combination of compute and storage architectures represents the most cost-effective design that satisfies all availability and performance requirements?

Design decision trade-offs

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Are you ready for the Professional Cloud Security Engineer?

50 questions in the full practice test

More Applying encryption methods to various use cases. practice questions

Get a free certification question with a full explanation every week.

Professional Cloud Security Engineer

Provider: Google Cloud
Passing score: 70%
Questions: 50
Duration: 90 minutes

Other sections in this exam

Configuring access
Securing communications and establishing boundary protection
Ensuring data protection
Managing operations
Supporting compliance requirements

Ask Scout

Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.

A security engineer is configuring end-to-end encryption in transit between application microservices and a Google Cloud SQL for PostgreSQL database instance. The database instance is provisioned using a shared Certificate Authority (shared CA) mode and is accessed over Private Service Connect (PSC).

To satisfy strict compliance and zero-trust policies, client connections must enforce complete cryptographic server identity verification to prevent spoofing and Man-in-the-Middle (MitM) attacks.

Which configuration should the security engineer implement?

Retrieve the instance DNS name from Cloud SQL, create a DNS record for it in a VPC private Cloud DNS zone, and configure the database client to connect to that DNS name using sslmode=verify-full.

Configure the database client to connect directly to the Private Service Connect endpoint's internal IP address with sslmode=verify-full.

Configure a Cloud KMS Customer-Managed Encryption Key (CMEK) to sign database sessions and set the client to sslmode=require.

Connect directly to the Private Service Connect IP address and set the PostgreSQL client connection parameter to sslmode=verify-ca.

Retrieve the instance DNS name from Cloud SQL, create a DNS record for it in a VPC private Cloud DNS zone, and configure the database client to connect to that DNS name using sslmode=verify-full.

What Complete Server Identity Verification Is

Server identity verification with TLS ensures that the client not only validates that the database server's certificate was signed by a trusted Certificate Authority (CA), but also validates that the certificate's Subject Alternative Name (SAN) matches the exact hostname to which the client is connecting.

How It Meets the Requirements

Shared CA Identity Assurance: When a Cloud SQL instance uses a shared CA, multiple database instances share the same root/intermediate CA. Validating only the CA chain is insufficient because any instance signed by that shared CA would be trusted. Enforcing hostname verification against the instance-specific SAN guarantees the identity of the specific target instance.
Private Service Connect (PSC) Resolution: Cloud SQL instances with a shared CA contain the instance DNS name (e.g., INSTANCE_UID.PROJECT_DNS_LABEL.REGION_NAME.sql.goog.) in the server certificate's SAN field. Registering this name in a VPC private Cloud DNS zone ensures that private clients correctly resolve the DNS name to the PSC endpoint IP.
Client Verification Mode: Setting sslmode=verify-full in PostgreSQL client drivers enforces both trusted CA validation and strict SAN hostname matching.

Key Advantages

MitM and Spoofing Prevention: Prevents malicious or misconfigured instances sharing the same root CA from intercepting traffic.
Private Route Integration: Operates seamlessly inside private VPC networks via Cloud DNS and Private Service Connect.
Zero-Trust Compliance: Meets strict regulatory standards for data-in-transit authenticity and non-repudiation.

Why This Is Optimal

This solution properly aligns DNS resolution, certificate SAN metadata, and client TLS enforcement (sslmode=verify-full), providing end-to-end cryptographic trust.

Configure the database client to connect directly to the Private Service Connect endpoint's internal IP address with sslmode=verify-full.

Configure a Cloud KMS Customer-Managed Encryption Key (CMEK) to sign database sessions and set the client to sslmode=require.

Connect directly to the Private Service Connect IP address and set the PostgreSQL client connection parameter to sslmode=verify-ca.