Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Google Cloud uses TLS for all external traffic to its APIs.

  Why this is correct

  Google Cloud mandates TLS (HTTPS) for every external call to its public API endpoints, covering services like BigQuery and Cloud Storage. This requirement is enforced at the infrastructure level, so clients must use TLS to communicate, regardless of the client library or SDK. As a result, data confidentiality and integrity are protected from the client to Google's edge, and users do not need to configure certificates themselves.

• ✓

  Data in transit between Google Cloud regions is encrypted by default.

  Why this is correct

  When traffic flows between Google Cloud regions over Google's global backbone, it is encrypted by default using network-level encryption. This includes techniques such as MACsec or IPsec, applied automatically to protect data from physical or logical compromises within the network. Google publicly committed to this since 2017, and it requires no configuration from the customer, covering both inter-region and intra-region traffic. This is an additional layer beyond application-layer TLS.

• ✗

  Users must configure TLS certificates for all Google Cloud services.

  Why it's wrong here

  The statement that users must configure TLS certificates for all Google Cloud services is incorrect. For Google-managed API endpoints, Google handles the TLS certificates automatically, and customers only need to manage certificates for their own applications running on compute resources. Many services, such as Cloud Load Balancing, even offer managed certificates that auto-renew. Thus, no universal user-side certificate configuration is required for Google Cloud services.

• ✗

  Data in transit between Google Cloud and the internet is encrypted by default for all services.

  Why it's wrong here

  It is a misconception that all data between Google Cloud and the internet is encrypted by default for every service. For instance, a Compute Engine VM running an HTTP server will accept plaintext HTTP unless the user explicitly enables TLS. Similarly, some legacy services or custom ports may not enforce TLS. While Google encourages TLS and offers managed HTTPS, default encryption applies mainly to Google's API endpoints, not to all traffic initiated or received by user workloads.

• ✗

  Encryption in transit uses AES-256.

  Why it's wrong here

  Encryption in transit is not characterized by a single cipher like AES-256; it relies on protocols such as TLS 1.2/1.3, which negotiate a cipher suite from existing options. These suites often use ephemeral key exchange algorithms (e.g., ECDHE) for forward secrecy and symmetric encryption like AES-GCM or ChaCha20 for data protection. AES-256, in contrast, is the default symmetric key size for encryption at rest, such as in Persistent Disk or Cloud Storage, so the statement conflates two different encryption contexts.

Go deeper

Related to this question