In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard Which options should you recommend to meet the requirements?
A. Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
B. Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
C. Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients’ TLS connections.
D. Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.
|
Download Printable PDF. VALID exam to help you PASS. |
 |
it’s not possible to encrypt local SSDs with cmek, you have to let Google handle the encryption for those types of disk
from docs: https://cloud.google.com/compute/docs/disks#ssd_encryption
Local SSD encryption
Compute Engine automatically encrypts your data when it is written to local SSD storage space. You can’t use customer-supplied encryption keys with local SSDs.
Shouldnt it be B ?
https://services.google.com/fh/files/misc/googlecloud_european_commitments_whitepaper.pdf