Google Professional Cloud Security Engineer Question 328
Single answerGoogle Cloud PlatformYour organization is migrating a sensitive financial application to Google Cloud. The application handles highly sensitive customer data, and your compliance team requires full control over encryption keys. Additionally, the compliance policy mandates that encryption keys must not reside in Google Cloud but be managed externally. Which encryption solution should you choose to meet these requirements?
- A
Google default encryption
- B
Customer-managed encryption keys (CMEK)
- C
Cloud External Key Manager (EKM)
- D
Customer-supplied encryption keys (CSEK)
Show answer and explanation
Correct answer: C
Explanation
The correct answer is Cloud External Key Manager (EKM) because it enables organizations to manage their encryption keys externally while still integrating with Google Cloud services. This satisfies the compliance policy requiring that encryption keys must not reside in Google Cloud and provides the necessary control for sensitive financial applications. Other options either do not allow external key management (Google default encryption, CMEK) or do not fully integrate with Google Cloud (CSEK).
- A. Incorrect.
Google default encryption automatically encrypts data at rest using Google-managed keys. However, it does not provide the level of control over encryption keys or the external key management required by the compliance policy.
- B. Incorrect.
Customer-managed encryption keys (CMEK) allow you to manage encryption keys in Google Cloud's Key Management Service (KMS). While CMEK provides more control over keys compared to default encryption, it does not satisfy the requirement for external key management.
- C. Correct.
Cloud External Key Manager (EKM) allows you to manage keys outside of Google Cloud while still integrating with Google Cloud services for encryption. This solution meets the compliance requirement of managing encryption keys externally.
- D. Incorrect.
Customer-supplied encryption keys (CSEK) allow you to encrypt data using keys stored outside Google Cloud. However, this approach does not integrate with Google Cloud KMS and may not be as suitable for enterprise-scale use cases requiring external key management.