Google Professional Cloud Security Engineer Question 335
Select 2Google Cloud PlatformYour organization stores sensitive customer data in Google Cloud Storage and uses Customer-Managed Encryption Keys (CMEK) for encryption. During a recent security review, your team identified that one of the encryption keys used for a critical storage bucket is at the end of its lifecycle and needs to be rotated. What steps should you take to ensure the key is securely rotated and continues to meet compliance requirements?
- A
Create a new key version for the existing CMEK within Cloud KMS and update the key version used by the storage bucket.
- B
Re-encrypt all existing data in the storage bucket using the new key version.
- C
Disable the previous key version to prevent unauthorized access to previously encrypted data.
- D
Update the storage bucket's configuration to use a new, completely different encryption key.
- E
Ensure the IAM permissions for the new key version match the previous key version.
Show answer and explanation
Correct answers: A, E
Explanation
Key rotation in CMEK involves creating a new key version within the existing key and updating the resource configuration to use the new key version. This approach minimizes disruption and maintains compliance. Additionally, verifying that IAM permissions are consistent across key versions ensures that access control remains unaltered. Re-encrypting data or creating an entirely new key is unnecessary and could introduce complexity, while disabling the old key version prematurely might lead to access issues.
- A. Correct.
Correct: Creating a new key version ensures a secure rotation process without creating a new key entirely, which is aligned with best practices for CMEK.
- B. Incorrect.
Incorrect: Re-encrypting existing data is generally unnecessary for key rotation when using CMEK, as Cloud Storage automatically manages access to data encrypted with older key versions.
- C. Incorrect.
Incorrect: Disabling the previous key version is not recommended unless you are certain it is no longer needed, as it could lead to data access issues for data encrypted with that version.
- D. Incorrect.
Incorrect: Creating a completely new encryption key is unnecessary for key rotation. A new key version within the same key is the recommended approach.
- E. Correct.
Correct: Ensuring IAM permissions for the new key version match the previous version is essential to maintain consistent access control after the rotation.