Google Professional Cloud Security Engineer Question 339
Select 2Google Cloud PlatformYour organization is using Google Cloud's Customer-Managed Encryption Keys (CMEK) to encrypt data in BigQuery. Compliance requirements mandate that encryption keys be rotated every 90 days to ensure data security. You also need to ensure that old keys are no longer usable for encryption but should remain available for decryption of existing data. What steps should you take to meet these requirements?
- A
Schedule a key rotation in Cloud KMS for the CMEK every 90 days and ensure the old keys remain enabled.
- B
Manually create a new key version in Cloud KMS and update the BigQuery dataset to use the new key version.
- C
Revoke the old key version immediately after creating a new key version to comply with the compliance requirement.
- D
Ensure that old key versions are set to 'disabled' rather than 'destroyed' after rotation to allow decryption of existing data.
- E
Set up an alert to notify you when a key version is nearing 90 days old so you can perform manual key rotation.
Show answer and explanation
Correct answers: B, D
Explanation
To meet compliance requirements for rotating CMEK keys in Google Cloud, you need to manually create a new key version in Cloud KMS and update the resource (BigQuery dataset in this case) to use the new key version. Old key versions must be disabled, not revoked or destroyed, to ensure they can still decrypt existing data while preventing encryption of new data. Automated alerts can assist in tracking key rotation schedules but do not replace the need for manual key management in CMEK scenarios.
- A. Incorrect.
Scheduling key rotations automatically would be applicable to Google-managed keys but not for CMEK in Cloud KMS. CMEK key rotation requires manual intervention, such as creating a new key version.
- B. Correct.
Manually creating a new key version and updating the BigQuery dataset to use the new key version is the correct approach for rotating CMEK keys.
- C. Incorrect.
Revoking the old key version immediately would prevent it from being used for decryption, violating the requirement to enable decryption of existing data.
- D. Correct.
Disabling old key versions ensures they cannot be used for encryption while still allowing decryption of existing data, which aligns with compliance requirements.
- E. Incorrect.
Setting up an alert for key rotation may be useful for tracking purposes, but it does not fulfill the actual requirement to rotate and manage keys in the scenario.