Cloud External Key Manager and Confidential VM Implementation Constraints

PCSE By islever Editorial Last updated

Managing encryption at rest, in transit, and in use. Managing service accounts.

Short answer

BC Configure Cloud External Key Manager to manage the encryption key externally and create new Confidential VMs to ensure data is encrypted in use.

Question

You manage a mission-critical workload for your organization, which is in a highly regulated industry. The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpoint computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements:
• Manage the data encryption key (DEK) outside the Google Cloud boundary.
• Maintain full control of encryption keys through a third-party provider.
• Encrypt the sensitive data before uploading it to Cloud Storage.
• Decrypt the sensitive data during processing in the Compute Engine VMs.
• Encrypt the sensitive data in memory while in use in the Compute Engine VMs.
What should you do? (Choose two.)
  1. Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.
  2. Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs. Correct Answer
  3. Create Confidential VMs to access the sensitive data. Correct Answer
  4. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
  5. Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets.

Key Takeaways

The primary trap is assuming existing VMs can be migrated to Confidential VMs; they must be created with the feature enabled from the start.

This question tests the implementation of external key management and confidential computing. The correct approach uses Cloud External Key Manager for off-boundary keys and creating new Confidential VMs for in-memory encryption, as migration is not supported.

Common mistake: Option D is incorrect because you cannot migrate an existing Compute Engine VM to become a Confidential VM. The confidential computing configuration must be set during the initial instance creation process.

Expert Analysis

The scenario requires addressing two distinct security domains: data-at-rest key management and data-in-use protection.

First, the requirement to "Manage the data encryption key (DEK) outside the Google Cloud boundary" and "Maintain full control of encryption keys through a third-party provider" explicitly points to Cloud External Key Manager (EKM). Customer Managed Encryption Keys (CMEK) in Option A use keys stored within Google Cloud's Key Management Service (KMS), which violates the requirement for external key management. Therefore, Option B is correct.

Second, the requirement to "Encrypt the sensitive data in memory while in use" refers to Confidential Computing. This is achieved using Confidential VMs. However, the critical distinction lies in the implementation method. Comments from the community highlight that Confidential VMs cannot be created by migrating existing standard Compute Engine instances; the confidential computing capability must be enabled at the time of instance creation. Option D suggests "Migrate," which is technically impossible for converting an existing non-confidential VM into a confidential one. Option C correctly states to "Create Confidential VMs," aligning with the constraint that this feature is only available on new instances. Thus, Option C is the correct action, while D is a distractor relying on the misconception of live migration support.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When encountering requirements for 'external' or 'third-party' key control, immediately select External Key Manager over CMEK. For Confidential VMs, always check if the option implies modifying existing infrastructure versus provisioning new resources; since confidentiality is a boot-time/creation-time attribute, look for 'create' rather than 'migrate' or 'convert'.

Frequently Asked Questions

Can I convert an existing Compute Engine VM to a Confidential VM?

No. Confidential Computing capabilities must be enabled when the VM instance is first created. You cannot migrate or convert an existing standard VM to a Confidential VM.

What is the difference between CMEK and Cloud EKM?

CMEK stores keys in Google Cloud KMS, whereas Cloud EKM allows you to use encryption keys managed by a third-party provider outside the Google Cloud boundary, giving you full control over the key material.

More PCSE FAQ →

Community Votes

B
50%
C
30%
D
20%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 22 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 22

  1. ymkk 👍 4
    B,C is the answer. Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance
  2. cyberpunk21 👍 4
    confidential VM doesn't support live migration.
  3. mjcts 👍 3
    As per documentation: "You can only enable Confidential Computing on a VM when you first create an instance" Therefore it's C not D
  4. akg001 👍 3
    B and D
  5. i_am_robot 👍 2
    To meet the specified data protection requirements for sensitive data, including managing the data encryption key (DEK) outside the Google Cloud boundary and encrypting the sensitive data in memory while in use in the Compute Engine VMs, you should: B. Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs. D. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
Show 17 more comments
  1. MisterHairy 👍 2
    Correction. When enabling Confidential Computing, it must be done when the VM instance is first created. Therefore, the right answer is C. Create Confidential VMs to access the sensitive data is the more accurate choice.
  2. MoAk 👍 2
    D is 100% wrong. you cannot migrate existing VMs to enable a confidential VM. https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#limitations
  3. Simon6666 👍 2
    BC You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance
  4. EVEGCP 👍 2
    BC : Confidential VM does not support live migration. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations
  5. desertlotus1211 👍 2
    Answer B&C: You cannot migrate a regular CE VM to Confidential. You must a new Confidential VM, and then decommission the other one.
  6. Andrei_Z 👍 2
    I would go with BC as well
  7. MisterHairy 👍 1
    The correct choices are: B. Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs. Cloud External Key Manager allows you to use encryption keys stored outside of Google’s infrastructure, providing full control over the key material. D. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data. Confidential VMs offer a breakthrough technology that encrypts data in-use, allowing you to work on sensitive data sets without exposing the data to the rest of the system. Option C involves creating new Confidential VMs, but it’s more efficient to migrate the existing Compute Engine VMs to Confidential VMs as stated in Option D.
  8. ArizonaClassics 👍 1
    B. Configure Cloud External Key Manager (EKM) to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data. Confidential VMs allow you to encrypt data in use (in memory). These VMs ensure that data remains encrypted when it's being used and processed. This aligns with the requirement to encrypt sensitive data in memory while in use in the Compute Engine VMs.
  9. irmingard_examtopics 👍 1
    You must create a new VM instance to enable Confidential VM. Existing instances can't be converted to Confidential VM instances. https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#limitations
  10. gcp4test 👍 1
    D - because: You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance So cant migrate, need to create new one.
  11. pfilourenco 👍 1
    encryption keys through a third-party provider and decrypt at the compute - B Encrypt the sensitive data in memory while in use in the Compute Engine VMs - D
  12. ppandher 👍 1
    In summary, options A and B are the most appropriate choices to meet the specified data protection requirements for sensitive data in this scenario.
  13. anshad666 👍 1
    C because Confidential VM does not support live migration.
  14. akilaz 👍 1
    That's right, no idea why BD is the correct answer.
  15. pradoUA 👍 1
    Hence the answer should be B and C
  16. Mr_MIXER007 👍 1
    B and D go with
  17. gkarthik1919 👍 1
    BC . Agree.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

Integrating On-Premises Active Directory with Google Cloud IAM

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

← Back to PCSE Study Guide