Google Professional Cloud Security Engineer Question 332
Single answerGoogle Cloud PlatformYour organization needs to implement a key management solution for encrypting sensitive customer data stored in Google Cloud Storage. The security team has strict compliance requirements that mandate the use of FIPS 140-2 Level 3 validated hardware for cryptographic operations. However, they also want to maintain flexibility to manage keys programmatically. Which key management approach should you recommend?
- A
Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS software keys.
- B
Use Cloud HSM to manage and store keys in a FIPS 140-2 Level 3 hardware module.
- C
Use Google-managed encryption keys to take advantage of built-in encryption.
- D
Use external key management with an on-premises hardware security module (HSM).
Show answer and explanation
Correct answer: B
Explanation
To meet the compliance requirements for FIPS 140-2 Level 3 hardware and provide the flexibility to programmatically manage keys, Cloud HSM is the best solution. It integrates seamlessly with Cloud KMS and ensures that keys are stored in hardware security modules that meet the required compliance levels. Other options either do not meet the compliance requirement or lack the programmatic flexibility needed.
- A. Incorrect.
CMEK with Cloud KMS software keys uses software-based protection for keys managed by Google Cloud. This does not meet the FIPS 140-2 Level 3 hardware compliance requirement.
- B. Correct.
Cloud HSM is a managed service that provides FIPS 140-2 Level 3 validated hardware for key storage. It also integrates with Cloud KMS, allowing programmatic access to manage keys, which aligns with the requirements.
- C. Incorrect.
Google-managed encryption keys are fully managed by Google Cloud and do not provide control over hardware compliance or programmatic key management.
- D. Incorrect.
Using external key management with an on-premises HSM would meet the FIPS 140-2 Level 3 compliance but would not offer the flexibility to manage keys programmatically within the Google Cloud ecosystem.