Google Professional Cloud Security Engineer Question 345
Select 3Google Cloud PlatformYour organization processes sensitive customer data and stores it in Google Cloud Storage. To comply with regulatory requirements, you need to ensure that all data is encrypted using a customer-managed encryption key (CMEK). Which of the following steps should you take to implement this encryption method?
- A
Create a Cloud KMS key ring and key, and configure the Cloud Storage bucket to use the key for encryption.
- B
Rely on Google-managed encryption keys, as they are sufficient for regulatory compliance.
- C
Grant the Cloud Storage service account access to the specific Cloud KMS key.
- D
Update the bucket's IAM policy to only allow access to users with 'roles/storage.admin' permissions.
- E
Rotate the Cloud KMS key periodically to follow best practices.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement CMEK for a Cloud Storage bucket, you must create a Cloud KMS key and configure the bucket to use it for encryption. Additionally, the Cloud Storage service account must have permissions to access the KMS key. Rotating the key periodically is a best practice to maintain security. Google-managed encryption keys are not suitable for use cases requiring CMEK, and modifying IAM policies unrelated to encryption configuration does not fulfill the requirements.
- A. Correct.
Correct: Creating a Cloud KMS key ring and key is the first step to configuring CMEK for a Cloud Storage bucket.
- B. Incorrect.
Incorrect: Google-managed encryption keys are not sufficient for scenarios that explicitly require customer-managed encryption keys (CMEK) for compliance.
- C. Correct.
Correct: Granting the Cloud Storage service account access to the Cloud KMS key is necessary for the bucket to use the key for encryption.
- D. Incorrect.
Incorrect: Updating the IAM policy to allow 'roles/storage.admin' has no direct relation to configuring CMEK for the bucket. This role is about access control for the bucket, not encryption.
- E. Correct.
Correct: Rotating the Cloud KMS key periodically ensures the encryption method adheres to security best practices.