Google Professional Cloud Security Engineer Question 324
Single answerGoogle Cloud PlatformYour organization is deploying a new application on Google Cloud that stores highly sensitive user data in Cloud Storage and Cloud SQL. The compliance requirements mandate that encryption keys must be managed externally, and the organization must maintain full control over the encryption keys at all times. Which encryption option best meets these requirements?
- A
Google default encryption
- B
Customer-managed encryption keys (CMEK)
- C
Cloud External Key Manager (EKM)
- D
Customer-supplied encryption keys (CSEK)
Show answer and explanation
Correct answer: C
Explanation
The organization’s compliance requirements explicitly mandate that encryption keys must be managed externally, and the organization must maintain full control over them. Cloud External Key Manager (EKM) allows keys to remain outside Google Cloud infrastructure, ensuring compliance with these requirements. Other options, like Google default encryption, CMEK, or CSEK, either rely on Google infrastructure to manage keys or require the keys to be uploaded to the cloud, which does not meet the external management criteria.
- A. Incorrect.
Google default encryption automatically encrypts data at rest using Google-managed keys. However, it does not allow customers to control or manage the encryption keys, which does not meet the compliance requirement of maintaining full control over the keys.
- B. Incorrect.
Customer-managed encryption keys (CMEK) allow customers to manage their keys through Cloud Key Management Service (KMS) but the keys are still stored within Google Cloud infrastructure. This does not satisfy the requirement for externally managed keys.
- C. Correct.
Cloud External Key Manager (EKM) allows the organization to store and manage encryption keys externally in their own key management system, ensuring full control over the keys. This satisfies the compliance requirements for external key management.
- D. Incorrect.
Customer-supplied encryption keys (CSEK) allow customers to supply their own encryption keys, but these keys are uploaded to Google Cloud for encryption operations. This does not meet the requirement of maintaining full control over the keys externally.