Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication

  Why it's wrong here

  This option misstates Google's default security posture. Google does not rely on customer-configured TLS for service-to-service traffic; instead, its internal Application Layer Transport Security (ALTS) automatically authenticates and encrypts all inter-service communication, including traffic that never leaves Google's infrastructure. Requiring customers to set up TLS for every service-to-service path would be operationally impossible, which is why Google's default encryption is a foundational security feature rather than a customer obligation.

• ✓

  Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required

  Why this is correct

  Google uses Application Layer Transport Security (ALTS) to authenticate and encrypt all traffic between Google services and between data centers by default. This is a core Google infrastructure security commitment, not an optional feature customers must enable.

• ✗

  Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance

  Why it's wrong here

  This option incorrectly assumes Google's internal network is left exposed for performance reasons. In reality, Google uses Application Layer Transport Security (ALTS) to encrypt the vast majority of internal traffic—including traffic between data centers and between services—without meaningful performance degradation, because encryption is implemented at the application layer with hardware acceleration and careful protocol design. While some legacy or low-level infrastructure traffic may have been unencrypted historically, modern Google Cloud default security encrypts internal traffic, and the performance trade-off is considered acceptable, not a reason to forgo encryption.

• ✗

  Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network

  Why it's wrong here

  This option draws the boundary at the wrong place. Customers are indeed responsible for encrypting traffic between their own applications and Google's services (e.g., using TLS for API calls), but traffic that transits Google's internal network—between Google's services, data centers, and regions—is protected by Google's built-in ALTS encryption by default. It is not the customer's responsibility to encrypt traffic within Google's cloud backbone; Google owns and secures that portion of the path. The misconception conflates the customer's endpoint responsibilities with Google's infrastructure protections, which are separate and automatically enforced.

Go deeper

Related to this question