Google Professional Cloud Security Engineer Question 341
Single answerGoogle Cloud PlatformYou are designing a secure data storage solution for a healthcare application hosted on Google Cloud. The application stores sensitive patient data in Cloud Storage and must comply with HIPAA regulations. The data should be encrypted at rest, and the encryption keys must remain under your organization's control. Which encryption method should you choose?
- A
Google-managed encryption keys (default encryption)
- B
Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
- C
Customer-supplied encryption keys (CSEK)
- D
Keyless encryption using Confidential Computing
Show answer and explanation
Correct answer: B
Explanation
For this scenario, CMEK (Customer-managed encryption keys) using Cloud KMS is the most appropriate choice as it allows the organization to maintain control over the encryption keys while simplifying the process of key management. It also helps comply with regulatory requirements like HIPAA, which often mandate strict control over encryption keys and the data they protect.
- A. Incorrect.
Google-managed encryption keys are the default encryption option in Cloud Storage, but they do not allow you to control the encryption keys. This does not meet the requirement for the keys to remain under your organization's control.
- B. Correct.
Customer-managed encryption keys (CMEK) allow you to use Cloud KMS to manage and control your encryption keys. This meets the requirement of keeping keys under your organization's control while complying with HIPAA regulations.
- C. Incorrect.
Customer-supplied encryption keys (CSEK) allow you to supply your own keys for encryption, but this approach increases operational complexity and key management overhead. While it provides control over the keys, it is not the most efficient choice for this use case.
- D. Incorrect.
Keyless encryption using Confidential Computing is not related to encryption at rest in Cloud Storage. It focuses on encrypting data in use, not at rest, so it does not meet the requirements of this scenario.