Google Professional Cloud Security Engineer Question 333
Single answerGoogle Cloud PlatformYour organization is developing a highly sensitive financial application on Google Cloud. The application requires encryption keys for securing sensitive data. Regulatory compliance mandates that keys must remain under strict control, and any unauthorized access to the keys would have severe consequences. Additionally, the system must support high-performance key operations and integration with existing Google Cloud services. In this scenario, which key management approach should you choose?
- A
Use Cloud KMS with software keys managed by Google.
- B
Use Cloud KMS with customer-managed software keys.
- C
Use Cloud HSM to manage hardware-backed keys.
- D
Use Google Cloud's default encryption without managing any keys.
Show answer and explanation
Correct answer: C
Explanation
For highly sensitive applications, especially those with regulatory compliance requirements, robust security and full control over encryption keys are critical. Cloud HSM ensures keys are hardware-protected, providing a higher level of security and meeting compliance needs better than software-managed keys. Default encryption, while secure, does not offer the necessary level of control required in this scenario.
- A. Incorrect.
Cloud KMS with software keys managed by Google relies on Google to manage the lifecycle of the encryption keys. While convenient, it may not satisfy strict regulatory compliance requirements that demand full customer control over keys.
- B. Incorrect.
Cloud KMS with customer-managed software keys provides more control, but software-based keys are not as secure as hardware-backed keys. This may not meet compliance requirements for sensitive financial data.
- C. Correct.
Cloud HSM provides hardware-backed keys, which are stored in a dedicated hardware security module. This approach offers higher security and meets regulatory requirements for handling sensitive data, making it the best choice for this scenario.
- D. Incorrect.
Google Cloud's default encryption automatically encrypts data but does not provide customer control over keys. This option would not satisfy regulatory compliance requiring strict key management.