Google Professional Cloud DevOps Engineer Question 80
Select 2Google Cloud PlatformYour organization is using Google Cloud Key Management Service (Cloud KMS) to manage encryption keys for its cloud applications. A developer accidentally deletes a key version that is still in use by a production application. What steps should you take to restore application functionality while minimizing security risks?
- A
Restore the deleted key version from a Cloud KMS backup.
- B
Re-create the deleted key version and re-encrypt the data in the production application with the new key version.
- C
Use the Cloud KMS key rotation feature to create a new key version and update the application to use the new version.
- D
Investigate if the application is using a different key version within the key ring and update the application to use that version.
- E
Re-enable the deleted key version by using the 'undelete' feature in Cloud KMS.
Show answer and explanation
Correct answers: B, C
Explanation
When a key version is deleted in Cloud KMS, it cannot be recovered. To restore application functionality, you can either re-create the key version (and re-encrypt the data) or use the key rotation feature to generate a new key version and update the application to use it. These approaches ensure data is secured and functionality is restored while adhering to Google Cloud's best practices for key management.
- A. Incorrect.
Cloud KMS does not provide a direct method to restore deleted key versions. Backups are not a supported feature for key versions.
- B. Correct.
Re-creating the deleted key version and re-encrypting the data with the new key version is a valid approach to restore functionality while maintaining security.
- C. Correct.
Using the key rotation feature to create a new key version and updating the application to use the new version is a secure way to restore functionality while adhering to best practices.
- D. Incorrect.
Although investigating other key versions in the key ring may seem logical, production data should not rely on random key versions, as this could lead to security risks or data corruption.
- E. Incorrect.
Once a key version is deleted, it cannot be re-enabled or restored in Cloud KMS. There is no 'undelete' feature available.