Google Professional Cloud Security Engineer Question 323
Single answerGoogle Cloud PlatformYour organization is storing sensitive financial data in Google Cloud Storage and needs to ensure compliance with stringent regulatory requirements, including the ability to revoke encryption keys instantly, even if they are stored outside Google Cloud. Which encryption approach is the most suitable in this scenario?
- A
Google default encryption
- B
Customer-managed encryption keys (CMEK)
- C
Cloud External Key Manager (EKM)
- D
Customer-supplied encryption keys (CSEK)
Show answer and explanation
Correct answer: C
Explanation
Cloud External Key Manager (EKM) is the best choice for this scenario because it enables customers to manage encryption keys outside Google Cloud infrastructure, allowing for instant revocation and meeting stringent compliance requirements. Other options, such as Google default encryption and CMEK, are managed within Google Cloud and do not provide the level of control required in this regulatory context.
- A. Incorrect.
Google default encryption automatically encrypts data at rest using Google-managed keys. While this approach provides strong encryption, it does not allow the customer to manage or instantly revoke the keys, which is required for compliance in this scenario.
- B. Incorrect.
Customer-managed encryption keys (CMEK) allow customers to manage their own encryption keys within Google Cloud. However, these keys are still managed within Google Cloud’s infrastructure and cannot be revoked instantly if stored outside the cloud, which is a requirement here.
- C. Correct.
Cloud External Key Manager (EKM) allows customers to integrate an external key management system to manage encryption keys outside Google Cloud. This enables instant key revocation and aligns perfectly with the need for regulatory compliance in this scenario.
- D. Incorrect.
Customer-supplied encryption keys (CSEK) allow customers to provide their encryption keys for data encryption. However, CSEK does not integrate with external key management systems for instant revocation, making it unsuitable in this scenario.