Google Professional Cloud Security Engineer Question 329
Select 2Google Cloud PlatformYour organization is deploying a new application that handles highly sensitive financial transactions. The security team is tasked with ensuring cryptographic keys are managed securely. They are debating whether to use software-based keys managed in Cloud Key Management Service (KMS) or hardware security module (HSM)-backed keys. Under which circumstances should the team choose HSM-backed keys instead of software keys?
- A
When the organization needs to comply with strict regulatory requirements like FIPS 140-2 Level 3.
- B
When the application requires low-latency access to cryptographic keys.
- C
When the organization wants greater control over the geographical location of the key material.
- D
When the organization needs to ensure the highest level of physical key security.
- E
When the organization wants to reduce costs associated with key management.
Show answer and explanation
Correct answers: A, D
Explanation
HSM-backed keys are preferred when compliance with stringent regulatory standards, such as FIPS 140-2 Level 3, is required or when the highest level of physical security for key material is necessary. Software keys, while cost-effective and sufficient for many use cases, do not provide the same level of regulatory compliance or physical security as HSM-backed keys.
- A. Correct.
HSM-backed keys are required to meet compliance with strict regulatory standards, such as FIPS 140-2 Level 3, which mandates hardware-based security.
- B. Incorrect.
HSM-backed keys typically have higher latency compared to software keys, as they involve hardware interaction. This makes this option incorrect.
- C. Incorrect.
Geographical control over key material can be achieved with both software keys and HSM-backed keys by leveraging Google Cloud's location-specific key management settings. This is not exclusive to HSM-backed keys.
- D. Correct.
HSMs provide the highest level of physical security for key material as they are tamper-resistant devices, making them suitable for highly sensitive or critical use cases.
- E. Incorrect.
HSM-backed keys often involve higher costs due to the hardware and operational overhead. This makes this option incorrect.