A financial organization is establishing baseline compute and workload security controls on Google Cloud to comply with strict regulatory mandates. The architecture includes workloads running on Compute Engine instances and Google Kubernetes Engine (GKE) clusters. The regulatory framework requires the following technical safeguards: Data-in-use protection: Sensitive data must remain encrypted in host memory during execution. Boot integrity: Nodes and virtual machines must detect and prevent boot-level rootkits and kernel tampering. Workload supply chain integrity: Only cryptographically verified and attested container images can be deployed to production clusters. Host hardening and exposure reduction: Node operating systems must have a minimal attack surface and avoid direct public internet exposure. Which combination of Google Cloud security controls and configurations should the organization implement to satisfy these compliance requirements?

Enable Confidential VMs and Confidential GKE Nodes; activate Shielded VM features (Secure Boot, vTPM, and Integrity Monitoring); enforce Binary Authorization deploy policies; and deploy private GKE clusters utilizing Container-Optimized OS (COS).: What the Combined Solution Is This architecture combines Google Cloud's core compute hardening and isolation services: Confidential Computing, Shielded VMs/GKE Nodes, Binary Authorization, and Container-Optimized OS (COS) in a private cluster topology to establish an end-to-end trusted computing and workload isolation baseline. How It Meets the Requirements Data-in-use protection: Confidential VMs and Confidential GKE Nodes leverage hardware-based memory encryption (such as AMD Secure Encrypted Virtualization [SEV]) to encrypt data in RAM during processing, ensuring that hypervisors, host OS components, or co-located processes cannot read unencrypted data in memory. Boot integrity: Shielded VM features—specifically Secure Boot, Virtual Trusted Platform Module (vTPM), and Integrity Monitoring—cryptographically verify firmware and kernel components against known baselines during startup and alert on any kernel or driver tampering. Workload supply chain integrity: Binary Authorization acts as a Kubernetes admission controller that intercepts pod deployment requests and validates cryptographic digital signatures (attestations) against defined enterprise signature policies before allowing containers to run. Host hardening and exposure reduction: Container-Optimized OS (COS) provides an immutable, minimal, security-enhanced Linux OS optimized for container runtimes, while private GKE clusters prevent worker nodes from having public IP addresses, eliminating direct internet-based attack vectors such as SSH exploits. Key Advantages Zero-trust host model: Encrypts memory payloads while preserving performance without requiring code changes to applications. Supply chain governance: Guarantees that only CI/CD-built and vulnerability-checked container images matching required attestations reach production. Tamper detection: Automatically generates audit logs and alerts if host boot sequence hashes deviate from the signed baseline. Reduced attack surface: Minimizes installed packages and open ports on host nodes, mitigating vulnerabilities like CVE-2024-6387 in exposed administrative services. Why This Is Optimal This solution comprehensively addresses each technical layer—hardware memory encryption, boot-level verification, deployment-time image attestation, and hardened network isolation—without creating architectural gaps or relying on controls limited to data-at-rest.

Compute Gke Compliance Workload Isolation Baseline | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise is establishing a data governance and encryption framework on Google Cloud to comply with strict regional data sovereignty and regulatory standards. The compliance baseline dictates the following technical requirements: All regional service data must be encrypted using Customer-Managed Encryption Keys (CMEK) protected by hardware security modules (Cloud HSM). Key management must enforce strict separation of duties between key custodians and application resource administrators. Key rotation must occur periodically such that newly written data uses the latest cryptographic key version while existing historical data remains continuously decryptable without data loss. Which Cloud KMS configuration and lifecycle management strategy should the security architect specify?

Determining technical needs relative to compute, data, network, and storage.

AdvancedProfessional Cloud Security Engineer

A financial enterprise is designing a network architecture on Google Cloud to adhere to strict regulatory compliance standards for sensitive data workloads. The organization must meet the following security requirements: Prevent data exfiltration from Google-managed services (such as Cloud Storage and BigQuery) to unauthorized external storage resources or accounts. Ensure internal virtual machines (VMs) without external IP addresses access supported Google APIs exclusively over a private Google routing path. Restrict inbound HTTP(S) traffic to public-facing applications at the network edge based on source CIDR blocks and protect backends from direct internet exposure. Allow secure administrative SSH access to internal VMs without assigning public IP addresses or exposing port 22 directly to the public internet. Which combination of Google Cloud architectural controls should the enterprise implement?

Determining technical needs relative to compute, data, network, and storage.

AdvancedProfessional Cloud Security Engineer

An enterprise uses Cloud Identity to govern administrative access to Google Cloud projects hosting mission-critical workloads. A recent internal red-team assessment demonstrated that threat actors could execute adversary-in-the-middle (AitM) reverse-proxy phishing attacks to intercept session cookies and bypass standard multi-factor authentication methods, such as SMS codes and mobile authenticator push prompts. The security architect must enforce an authentication policy for all privileged administrators that eliminates credential harvesting and AitM relay attacks. Which 2-Step Verification (2SV) configuration should the architect implement?

Configuring and enforcing 2-step verification.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is establishing separation of duties for an automated compliance bot. The bot must continuously audit and remediate Identity and Access Management (IAM) allow policies across multiple Google Cloud projects. The solution must satisfy the following security constraints: Allow the bot to read project-level IAM allow policies and apply updated allow policies. Prevent the bot from reading sensitive application data, creating or deleting cloud infrastructure, or managing project lifecycle settings. Enforce the principle of least privilege by avoiding basic roles and overly broad administrative roles. Which IAM role configuration should the security team grant to the bot?

Managing privileged roles and separation of duties with Identity and Access Management (IAM) roles and permissions.

AdvancedProfessional Cloud Security Engineer

An enterprise enforces mandatory 2-Step Verification (2SV) across all user accounts in Cloud Identity. A security team needs to establish a secure recovery workflow for users who lose their physical security keys and want to proactively detect security exceptions, such as unauthorized disabling of 2SV or suspicious account activity. Which combination of administrative delegation and auditing controls should the security team implement?

Configuring and enforcing 2-step verification.

IntermediateProfessional Cloud Architect

Persistent Disk IOPS vCPU and Capacity Limit

Data storage allocation

Professional Cloud Security Engineer

Compute Gke Compliance Workload Isolation Baseline

Related questions

Persistent Disk IOPS vCPU and Capacity Limit

Professional Cloud Security Engineer

Compute Gke Compliance Workload Isolation Baseline

What the Combined Solution Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions

Persistent Disk IOPS vCPU and Capacity Limit

What the Combined Solution Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal