Google Professional Cloud Security Engineer Question 343
Single answerGoogle Cloud PlatformYour company is storing sensitive customer data in Google Cloud Storage. Compliance requirements mandate that the data must be encrypted using keys managed by your organization. Additionally, you need to ensure that there is centralized control over key management and rotation. Which encryption method should you choose to meet these requirements?
- A
Use Google-managed encryption keys (default encryption).
- B
Use customer-managed encryption keys (CMEK) with Cloud Key Management Service (KMS).
- C
Use customer-supplied encryption keys (CSEK).
- D
Use an on-premises key management solution to encrypt data before uploading.
Show answer and explanation
Correct answer: B
Explanation
In this scenario, customer-managed encryption keys (CMEK) with Cloud KMS is the best choice because it allows your organization to maintain centralized control over encryption keys, including their creation, management, and rotation, while fully integrating with Google Cloud's services. This fulfills the compliance requirements more effectively than other options.
- A. Incorrect.
Google-managed encryption keys (default encryption) are automatically managed by Google and do not allow your organization to manage or rotate keys, which does not meet the compliance requirement for centralized control over key management.
- B. Correct.
Customer-managed encryption keys (CMEK) with Cloud Key Management Service (KMS) allow your organization to manage and rotate encryption keys centrally, meeting the compliance requirements for control and security.
- C. Incorrect.
Customer-supplied encryption keys (CSEK) allow you to supply your own keys but do not provide centralized key management or rotation capabilities, which is required by the scenario.
- D. Incorrect.
Encrypting data with an on-premises key management solution before uploading does not integrate with Google Cloud's native encryption services and would complicate centralized control and rotation of keys.