Google Professional Cloud Security Engineer Question 336
Select 3Google Cloud PlatformYour organization uses Google Cloud and has implemented Customer-Managed Encryption Keys (CMEK) for securing sensitive data in Cloud Storage. During a routine audit, it was discovered that an encryption key in Cloud KMS has been compromised. What steps should you take to ensure the security of your data while minimizing disruption to your services?
- A
Rotate the compromised encryption key to generate a new key version and update the associated services to use the new key version.
- B
Revoke access to the compromised key version to prevent further use.
- C
Immediately delete the compromised key from Cloud KMS to ensure it cannot be accessed.
- D
Re-encrypt existing data encrypted with the compromised key using the newly rotated key.
- E
Disable the entire key ring associated with the compromised key.
Show answer and explanation
Correct answers: A, B, D
Explanation
When a CMEK is compromised, it is important to rotate the key to generate a new key version, revoke access to the compromised version, and re-encrypt data using the new key. These steps ensure the security of data while minimizing disruption to services. Deleting the key outright or disabling the entire key ring can cause significant issues, including service downtime and data inaccessibility, and should be avoided.
- A. Correct.
Correct. Rotating the key generates a new key version while keeping the existing key in place, ensuring minimal disruption. Associated services should be updated to use the new key version.
- B. Correct.
Correct. Revoking access to the compromised key version ensures that it cannot be used further, which is critical for securing data.
- C. Incorrect.
Incorrect. Deleting the key immediately could cause data encrypted with that key to become inaccessible, leading to service disruptions.
- D. Correct.
Correct. Re-encrypting data with the new key ensures that data previously encrypted with the compromised key is secured.
- E. Incorrect.
Incorrect. Disabling the entire key ring is unnecessary and could affect other keys and services relying on that key ring, leading to unintended downtime.