Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by aliyah

By generating a key in your on-premises environment and storing it in an HSM that you manage, you're ensuring that the key material is fully under your control. Using the key as an external key in Cloud KMS allows you to use the key with Google Cloud services without having the key stored on Google Cloud. Activating Key Access Justifications (KAJ) provides a reason every time the key is accessed, and you can configure the external key system to reject unauthorized access attempts.

Objective: Identify the layers of the stack the customer shares responsibility for in a shared security responsibility model for IaaS.

Solution: Understand the shared responsibility model.

Explanation:

Network Security: Customers are responsible for configuring network security, such as setting up firewalls, managing VPCs, and ensuring secure network traffic.

Access Policies: Customers are responsible for managing access policies, including IAM roles and permissions, to ensure only authorized users can access resources.

In IaaS, the cloud provider is typically responsible for the underlying infrastructure, while the customer is responsible for securing their applications and data on the cloud.

References:

Shared Responsibility Model

Google Cloud Security Overview

https://cloud.google.com/blog/products/g-suite/7-ways-admins-can-help-secure-accounts-against-phishing-g-suite

https://www.duocircle.com/content/email-security-services/email-security-in-cryptography#:~:text=Customer%20Login-,Email%20Security%20In%20Cryptography%20Is%20One%20Of%20The%20Most,Measures%20To%20Prevent%20Phishing%20Attempts &text=Cybercriminals%20love%20emails%20the%20most,networks%20all%20over%20the%20world.