Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company is migrating its on-premises applications to Google Cloud. The security team requires that all data be encrypted both in transit and at rest. Which approach meets these requirements with minimal operational overhead?
⚠ Common exam trap
Google Cloud often tests the misconception that a VPN alone satisfies both encryption in transit and at rest requirements, but candidates must remember that VPNs only cover transit encryption and do not address data at rest within the cloud provider's infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use HTTPS for all traffic and enable default encryption at rest with Google-managed keys.
HTTPS provides encryption in transit using TLS, and default encryption at rest with Google-managed keys encrypts data stored in Google Cloud services like Cloud Storage and Compute Engine disks without requiring any manual key management. This approach meets the security requirements with minimal operational overhead since Google handles key rotation and lifecycle management automatically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use HTTPS for all traffic and enable default encryption at rest with Google-managed keys.
Why this is correct
Enabling HTTPS ensures all data in transit is protected via TLS, preventing eavesdropping and tampering between clients and Google Cloud services. Google Cloud automatically encrypts data at rest at the storage layer using AES-256, managed by Google's key infrastructure, without requiring customer configuration. This approach satisfies both encryption requirements with minimal operational overhead because the customer only needs to configure HTTPS endpoints while relying on Google's default, transparent encryption for stored data.
- ✗
Implement a third-party encryption tool for both transit and at rest.
Why it's wrong here
Deploying external software increases operational overhead because it requires managing additional infrastructure, patching, and integration layers. This approach fails the requirement for minimal management by introducing manual lifecycle tasks that Google Cloud's native, integrated encryption services automate. Third-party tools are appropriate when a company must maintain sovereign control over cryptographic keys within an on-premises environment or across multi-cloud architectures where provider-managed keys are prohibited.
- ✗
Set up a VPN between on-premises and Google Cloud and rely on that for encryption.
Why it's wrong here
A VPN provides an encrypted IPsec tunnel between on-premises infrastructure and Google Cloud, securing only the network path for traffic traversing it. However, it does not encrypt data stored in Google Cloud services (e.g., Compute Engine disks, Cloud Storage objects) nor does it protect application-level payloads if a service uses an unencrypted protocol over the tunnel. Additionally, relying solely on a VPN for encryption leaves data at rest unencrypted, violating the requirement to ensure both in-transit and at-rest protection.
- ✗
Restrict physical access to Google Cloud data centers.
Why it's wrong here
Restricting physical access to Google Cloud data centers is a security control against unauthorized hands-on manipulation, but it does not perform any cryptographic transformation of data. Physical security measures such as biometric locks, guards, and surveillance protect the hardware but cannot encrypt data stored on disks or traversing networks. Without encryption, any data exfiltrated via a compromised application or misconfigured service would remain readable, so physical access controls are orthogonal to the stated encryption requirement.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.