Google Professional Cloud Security Engineer Question 327
Single answerGoogle Cloud PlatformYour organization is migrating sensitive financial data to Google Cloud. Regulatory compliance requires you to retain full control over encryption keys and to manage key rotation policies independently of Google Cloud. Which encryption solution should you choose to meet these requirements?
- A
Google default encryption
- B
Customer-managed encryption keys (CMEK)
- C
Cloud External Key Manager (EKM)
- D
Bring Your Own Key (BYOK)
Show answer and explanation
Correct answer: C
Explanation
To meet the regulatory requirement of retaining full control over encryption keys and independently managing key rotation policies, Cloud External Key Manager (EKM) is the appropriate solution. It allows you to store and control encryption keys outside of Google Cloud, ensuring compliance and full ownership of the keys. Other options like default encryption, CMEK, or BYOK do not provide the level of independence and control required in this scenario.
- A. Incorrect.
Google default encryption automatically encrypts data at rest using keys managed by Google. However, it does not provide the ability for customers to control or manage their own keys, which is a requirement in this scenario.
- B. Incorrect.
Customer-managed encryption keys (CMEK) allow you to use your own encryption keys stored in Cloud Key Management Service (KMS). While it provides more control over key management than default encryption, the keys are still stored within Google Cloud, which does not meet the regulatory requirement for external key control.
- C. Correct.
Cloud External Key Manager (EKM) allows you to store and manage your encryption keys outside of Google Cloud, granting you complete control over key rotation policies and key ownership. This solution fully meets the requirement for retaining independent control over encryption keys.
- D. Incorrect.
Bring Your Own Key (BYOK) refers to importing an encryption key into Cloud KMS. Once the key is imported, Google Cloud manages the key lifecycle, which does not fulfill the requirement for independent key control.