Google Professional Cloud DevOps Engineer Question 219
Single answerGoogle Cloud PlatformYou are working as a Cloud DevOps Engineer for a company that handles sensitive customer data. The company uses Google Cloud to host its applications. To enhance security, you decide to use Cloud Key Management Service (Cloud KMS) for encryption key management. A highly sensitive service in your application requires frequent decryption operations, and you need to minimize latency while ensuring the encryption key remains secure. Which is the most appropriate key type to use for this scenario?
- A
Customer-managed encryption keys (CMEK) stored in Cloud KMS
- B
Customer-supplied encryption keys (CSEK)
- C
Google-managed encryption keys
- D
HSM-protected keys in Cloud KMS
Show answer and explanation
Correct answer: A
Explanation
Customer-managed encryption keys (CMEK) stored in Cloud KMS are the most appropriate choice in this scenario. They strike a balance between security and performance by leveraging Cloud KMS to securely manage the keys while minimizing latency for frequent decryption operations. Other options, such as CSEK or HSM-protected keys, either require more operational burden or introduce higher latency, making them less suitable for this use case.
- A. Correct.
Customer-managed encryption keys (CMEK) stored in Cloud KMS are the best option for this scenario as they provide strong security, minimal latency for decryption operations, and are managed by Cloud KMS. This allows for a balance of performance and security.
- B. Incorrect.
Customer-supplied encryption keys (CSEK) require you to manage the keys entirely on your own. This can introduce operational overhead and potential latency issues because decryption operations require external handling.
- C. Incorrect.
Google-managed encryption keys are managed entirely by Google and do not provide the same level of control or security customization as CMEK. These are suitable for less sensitive workloads.
- D. Incorrect.
HSM-protected keys in Cloud KMS provide the highest level of security by storing keys in hardware security modules (HSMs). However, this can introduce additional latency in high-frequency decryption operations, making it less suitable for this scenario.