Google Professional Cloud Security Engineer Question 338
Select 3Google Cloud PlatformYour organization is using Google Cloud's Customer-Managed Encryption Keys (CMEK) to secure sensitive data stored in Cloud Storage. The security team has mandated that keys must be rotated every 90 days and that all existing data encrypted with the old key version must be re-encrypted using the new key version. What steps should you take to comply with this requirement?
- A
Rotate the CMEK key version in Cloud KMS and ensure the new version is set as primary.
- B
Manually re-encrypt all existing data in Cloud Storage by rewriting the objects using the new CMEK key version.
- C
Delete the old CMEK key version immediately after creating the new one to prevent unauthorized use.
- D
Update your Cloud Storage bucket's encryption configuration to use the new CMEK key version for future writes.
- E
Enable automatic key rotation in Cloud KMS to ensure compliance with the 90-day policy.
Show answer and explanation
Correct answers: A, B, D
Explanation
To comply with the 90-day key rotation policy and ensure existing data is re-encrypted with the new key version, you must first rotate the key version in Cloud KMS, update the Cloud Storage bucket to use the new key for future writes, and manually re-encrypt existing data by rewriting it. Deleting old key versions prematurely can lead to data loss, and enabling automatic rotation only handles key version creation, not re-encryption of existing data.
- A. Correct.
Correct: Rotating the CMEK key version and setting the new version as primary ensures that all future encryption operations use the latest key version.
- B. Correct.
Correct: To re-encrypt existing data, you must rewrite the objects in Cloud Storage, as Google Cloud does not automatically re-encrypt data when the CMEK key version is rotated.
- C. Incorrect.
Incorrect: Deleting the old CMEK key version immediately could result in data encrypted with the old key being rendered inaccessible. Key versions should be retained until all data is re-encrypted.
- D. Correct.
Correct: Updating the encryption configuration ensures that all new data written to the bucket uses the latest CMEK key version.
- E. Incorrect.
Incorrect: While enabling automatic key rotation in Cloud KMS simplifies key management, it does not automatically re-encrypt existing data or guarantee compliance with specific rotation policies like 90 days.