Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Google uses third-party antivirus software to scan all hardware components for tampering before installation

  Why it's wrong here

  Antivirus software is a signature- and heuristic-based solution designed to detect malicious code in operating systems and applications, not physical tampering with hardware. A compromised motherboard, inserted implant, or altered firmware typically exists as low-level logic or flash content that an OS-resident scanner cannot inspect before boot, and third-party AV also cannot provide cryptographic proof that the hardware is genuine. Hardware supply chain security depends on a root of trust, such as Google's Titan chip, that independently attests to firmware integrity and machine identity.

• ✓

  Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance

  Why this is correct

  Titan is Google's hardware root of trust for supply chain security. It generates a cryptographic identity for the machine, verifies boot firmware hasn't been tampered with (preventing firmware attacks), and provides attestation that can be verified throughout the machine's lifecycle. This is a core component of Google's defense-in-depth security architecture.

• ✗

  Google relies on hardware manufacturers' security certifications to ensure supply chain integrity

  Why it's wrong here

  Manufacturer security certifications, such as Common Criteria, validate that a vendor's design and development processes meet certain assurance levels, but they are issued by (or in cooperation with) the vendor and do not provide per-device cryptographic proof of authenticity. A certified component can still be intercepted, swapped, or modified after leaving the factory, and a static certification cannot attest to the state of a specific machine at runtime. Titan offers independent, cryptographically verifiable evidence of machine identity and boot firmware integrity, removing the need to rely solely on the manufacturer's word.

• ✗

  Google encrypts all hardware components with AES-256 to prevent tampering

  Why it's wrong here

  Encryption, such as AES-256, is a data protection mechanism that transforms information into ciphertext; it cannot be applied to the physical material or circuits of a hardware component. Even if firmware or storage were encrypted, a tampered device could still be altered to bypass the encryption or to behave maliciously during operation. Google's approach uses cryptographic attestation from the Titan chip to corroborate that the boot firmware and server identity are intact, which is logically separate from encrypting data at rest.

Go deeper

Related to this question