Google Professional Cloud Security Engineer Question 342
Single answerGoogle Cloud PlatformYour organization stores sensitive customer data in Google Cloud Storage and requires encryption at rest to meet compliance requirements. The compliance policy also mandates that encryption keys must be fully controlled and managed by the organization. Which encryption method would best meet this requirement?
- A
Google-managed encryption keys (GMEK)
- B
Customer-managed encryption keys (CMEK) stored in Cloud Key Management Service (Cloud KMS)
- C
Customer-supplied encryption keys (CSEK)
- D
Default encryption provided by Google Cloud Storage
Show answer and explanation
Correct answer: C
Explanation
Customer-supplied encryption keys (CSEK) are the best option for organizations requiring complete control over encryption keys. With CSEK, the organization supplies its own keys and retains full responsibility for their storage and management. This meets the compliance policy’s requirement of full key control, unlike other options where Google Cloud retains some level of key management responsibility.
- A. Incorrect.
Google-managed encryption keys (GMEK) are managed entirely by Google Cloud. While they provide encryption for data at rest, they do not allow the organization to fully control the encryption keys, which does not meet the compliance requirement.
- B. Incorrect.
Customer-managed encryption keys (CMEK) stored in Cloud KMS allow the organization to manage encryption keys to some extent, but the keys are still stored and managed within Google Cloud services. This does not provide full control as required by the compliance policy.
- C. Correct.
Customer-supplied encryption keys (CSEK) allow the organization to supply and manage its own encryption keys entirely outside of Google Cloud. This ensures full control over the encryption keys, meeting the stated compliance requirement.
- D. Incorrect.
Default encryption provided by Google Cloud Storage uses Google-managed encryption keys. This does not allow the organization to control or manage its encryption keys, failing to meet the compliance requirement.