Google Professional Cloud Security Engineer Question 334
Select 2Google Cloud PlatformYour organization is implementing a secure system for encrypting sensitive data in Google Cloud. The security team wants to ensure that the encryption keys are managed in a way that balances security, compliance, and operational overhead. Which scenarios are best suited for using hardware keys instead of software keys?
- A
The organization requires FIPS 140-2 Level 3 compliance for encryption key storage.
- B
The organization needs to use Cloud KMS with a lower cost and faster deployment time.
- C
Regulatory requirements mandate that encryption keys be stored in tamper-resistant hardware.
- D
The organization needs to store and manage customer-managed encryption keys (CMEK) entirely within Google Cloud.
- E
The organization prioritizes ease of integration with other Google Cloud services over physical key storage.
Show answer and explanation
Correct answers: A, C
Explanation
Hardware keys provide higher levels of security and compliance compared to software keys, especially in scenarios where tamper-resistant hardware or strict regulatory compliance (e.g., FIPS 140-2 Level 3) is required. Software keys are better suited for scenarios prioritizing cost-efficiency, ease of use, and integration with cloud-native services.
- A. Correct.
Hardware keys are required for FIPS 140-2 Level 3 compliance, as this standard mandates the use of tamper-proof hardware for key management.
- B. Incorrect.
Software keys are generally less expensive and quicker to deploy compared to hardware keys, making this option suitable for fast deployments without hardware compliance needs.
- C. Correct.
Regulatory requirements that mandate tamper-resistant hardware are a key reason to choose hardware keys over software keys.
- D. Incorrect.
While software keys can be used for customer-managed encryption keys (CMEK) within Google Cloud, they do not provide the hardware-level security needed for higher compliance requirements.
- E. Incorrect.
Ease of integration with other Google Cloud services is typically a feature of software keys, which are more flexible and do not involve physical hardware.