The answer is to enable TLS encryption for all data in transit and to use VPC Service Controls to create a service perimeter. TLS ensures that data flowing between Cloud Pub/Sub, Dataflow workers, and BigQuery is encrypted against eavesdropping and man-in-the-middle attacks, which is the foundational security best practice for any streaming pipeline. VPC Service Controls then provide a virtual security boundary that prevents data exfiltration by restricting the movement of data to only authorized resources within your perimeter. On the Google Professional Data Engineer exam, this pairing tests your understanding that encryption alone is insufficient for compliance; you must also control the network boundary. A common trap is to confuse encryption at rest with in-transit protections or to overlook that VPC Service Controls specifically address data exfiltration risks. Remember the mnemonic: “TLS for the wire, VPC for the fire.”
PDE Practice Question: Building and operationalizing data processing systems
This PDE practice question tests your understanding of building and operationalizing data processing systems. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO security best practices should be applied to secure data in transit for a Dataflow streaming pipeline that reads from Cloud Pub/Sub and writes to BigQuery? (Choose 2)
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable TLS encryption on all endpoints
Option B is correct because TLS (Transport Layer Security) encryption ensures that data is encrypted during transmission between endpoints, such as between Cloud Pub/Sub and Dataflow workers, and between Dataflow workers and BigQuery. This is a fundamental security best practice for protecting data in transit against eavesdropping and man-in-the-middle attacks.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use Cloud Key Management Service (Cloud KMS) to encrypt data in transit
Why it's wrong here
Cloud KMS is used for managing keys for encryption at rest, not for transit.
✓
Enable TLS encryption on all endpoints
Why this is correct
TLS ensures data encryption between Google Cloud services, which is already enabled by default but should be verified.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✓
Use VPC Service Controls to create a service perimeter
Why this is correct
VPC Service Controls prevent unauthorized data export from the allowed services.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use Cloud Armor to protect against DDoS
Why it's wrong here
Cloud Armor provides DDoS protection, not data-in-transit encryption.
✗
Use private IP addresses for Dataflow workers
Why it's wrong here
Private IP addresses improve network security but do not encrypt data in transit.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse encryption at rest (Cloud KMS) with encryption in transit, or assume that using private IPs alone secures data in transit without needing TLS.
Detailed technical explanation
How to think about this question
Dataflow pipelines use gRPC and HTTP/2 for internal communication, which can leverage TLS 1.2 or 1.3 for encryption. When reading from Cloud Pub/Sub, the default gRPC connection uses TLS automatically, and for BigQuery writes, the Dataflow service uses HTTPS with TLS. VPC Service Controls (Option C) adds a security perimeter by preventing data exfiltration through context-aware access policies, which complements but does not replace encryption.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Building and operationalizing data processing systems — This question tests Building and operationalizing data processing systems — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable TLS encryption on all endpoints — Option B is correct because TLS (Transport Layer Security) encryption ensures that data is encrypted during transmission between endpoints, such as between Cloud Pub/Sub and Dataflow workers, and between Dataflow workers and BigQuery. This is a fundamental security best practice for protecting data in transit against eavesdropping and man-in-the-middle attacks.
What should I do if I get this PDE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PDE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.