Google Associate Cloud Engineer Question 231
Select 2Google Cloud PlatformYou are tasked with securing sensitive data stored in a Google Cloud Storage bucket. You need to ensure that the data is encrypted using customer-managed encryption keys (CMEK) and also restrict access to certain users. What steps should you take to achieve this?
- A
A. Enable Object Versioning in the bucket.
- B
B. Configure a Cloud Storage bucket to use a customer-managed key from Cloud Key Management Service (KMS) for encryption.
- C
C. Set up IAM policies to grant access to specific users only.
- D
D. Use the Cloud Console to enable default bucket-level encryption with Google-managed keys.
- E
E. Implement signed URLs for accessing the objects.
Show answer and explanation
Correct answers: B, C
Explanation
To secure sensitive data in Cloud Storage using customer-managed encryption keys (CMEK), you must configure the bucket to use a key from Cloud KMS. This ensures that encryption is managed by your organization's keys rather than Google's. Additionally, to restrict access to specific users, IAM policies should be set up appropriately. This combination of encryption and access control meets the requirements of the scenario.
- A. Incorrect.
Object Versioning is used for retaining, archiving, and retrieving deleted or overwritten objects, not for encryption or access control.
- B. Correct.
Configuring a Cloud Storage bucket to use a customer-managed key from Cloud KMS ensures that the data is encrypted using your own encryption keys.
- C. Correct.
Setting up IAM policies to grant access to specific users allows you to control who can access or modify the objects stored in the bucket.
- D. Incorrect.
Enabling default bucket-level encryption with Google-managed keys uses default encryption, but it does not use customer-managed keys as required.
- E. Incorrect.
Signed URLs provide temporary access to objects, but do not encrypt or manage access control in the way described in the scenario.