Google Professional Cloud Security Engineer Question 340
Select 2Google Cloud PlatformA financial services company is using Google Cloud to store sensitive customer data. They have opted to use Customer-Managed Encryption Keys (CMEK) with Cloud KMS for better control over encryption keys. The security team has identified a requirement to rotate the encryption keys every six months and immediately revoke access to a key if it is compromised. Which of the following steps should the security team take to meet these requirements?
- A
Use Cloud KMS to schedule automatic key rotation for the encryption keys.
- B
Manually rotate the keys by creating a new key version in Cloud KMS and updating resources to use the new version.
- C
Revoke access to the compromised key by disabling the key version in Cloud KMS.
- D
Delete the compromised key immediately to prevent access to encrypted data.
- E
Import a new key into Cloud KMS each time a rotation is required.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the requirements, the security team must manually rotate keys by creating a new key version and updating resources to use the new version. In the case of a compromised key, disabling the key version ensures that it cannot be used without risking data loss. Automatic key rotation is not currently supported in Cloud KMS, and deleting a key is unnecessarily destructive. Importing keys is unrelated to regular key rotation unless external keys are being used.
- A. Incorrect.
Cloud KMS does not support automatic key rotation scheduling. Key rotation must be handled manually or through an external process.
- B. Correct.
This is the correct step for manual key rotation in Cloud KMS. Creating a new key version and updating resources ensures a smooth transition to the new key.
- C. Correct.
Disabling the key version is the correct way to revoke access to a compromised key while maintaining access to data encrypted with other versions.
- D. Incorrect.
Deleting a key is not recommended because it permanently removes access to encrypted data, which could lead to data loss.
- E. Incorrect.
Key import is only required if you are using external keys (e.g., for EKM) and is not a necessary step for every key rotation.