Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Google Cloud Certified Professional Cloud Security Engineer · Google Cloud
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Disk Encryption with customer-managed keys: FIPS 140-2 compliance often requires encryption, and using customer-managed encryption keys (CMEK) ensures that you have control over the encryption keys, which can be crucial for compliance. Google Cloud supports FIPS 140-2 compliant encryption for data at rest with customer-managed keys. BoringSSL for data transit: BoringSSL is Google's fork of OpenSSL, designed to meet high standards of cryptographic security, including FIPS 140-2. Using BoringSSL for instance-to-instance communications ensures that data in transit is encrypted according to the necessary standards. Although UDP isn't inherently encrypted, you can implement encryption at the application layer using libraries like BoringSSL.
"BoringSSL as a whole is not FIPS validated. However, there is a core library (called BoringCrypto) that has been FIPS validated."
When you deploy Managed Instance Groups (MIGs), you typically create an instance template that defines the configuration of instances in the group, including the disk encryption settings.