Google Professional Cloud Security Engineer Question 331
Single answerGoogle Cloud PlatformYour organization is building a highly sensitive financial application on Google Cloud that handles customer payment data and requires compliance with strict regulations such as PCI DSS. The application needs to encrypt this data at rest and in transit. Regulatory requirements specify that the encryption keys must be stored in a tamper-resistant environment, and the key management process should minimize potential exposure to unauthorized access. As a Professional Cloud Security Engineer, what key management approach should you recommend?
- A
Use software-based keys managed by Google Cloud Key Management Service (KMS).
- B
Use software-based keys and manage them entirely on-premises outside of Google Cloud.
- C
Use Cloud HSM to generate and manage hardware-backed keys.
- D
Use Customer-Supplied Encryption Keys (CSEK) and store the keys in a secure location outside Google Cloud.
Show answer and explanation
Correct answer: C
Explanation
The scenario requires a key management approach that ensures compliance with strict regulations, including the need for tamper-resistant hardware for storing encryption keys. Cloud HSM is a fully managed service provided by Google Cloud that uses FIPS 140-2 Level 3 certified hardware to generate and manage encryption keys securely. This makes it the most appropriate solution for the given regulatory and security requirements.
- A. Incorrect.
Software-based keys managed by Google Cloud KMS are easy to use and integrate with other Google Cloud services. However, they do not meet the tamper-resistant hardware requirement specified in the scenario.
- B. Incorrect.
Managing software-based keys entirely on-premises can provide more control but does not meet the tamper-resistant hardware requirement and may increase operational complexity.
- C. Correct.
Cloud HSM provides a highly secure, tamper-resistant environment for managing hardware-backed keys, ensuring compliance with regulatory requirements like PCI DSS. It is the most appropriate solution for this scenario.
- D. Incorrect.
Customer-Supplied Encryption Keys (CSEK) allow for external control of encryption keys, but they do not provide a tamper-resistant environment for key management, as required by the scenario.