Google Professional Cloud Security Engineer Question 346
Single answerGoogle Cloud PlatformYour organization stores sensitive customer data in Google Cloud Storage and wants to ensure this data is encrypted at rest and that the encryption keys are managed by your internal security team. Which encryption method should you choose to meet this requirement?
- A
Google-managed encryption keys (default encryption)
- B
Customer-managed encryption keys (CMEK) with Cloud KMS
- C
Customer-supplied encryption keys (CSEK)
- D
Client-side encryption using a third-party library
Show answer and explanation
Correct answer: B
Explanation
Customer-managed encryption keys (CMEK) with Cloud KMS is the best option for organizations that want to encrypt data at rest while retaining control of the encryption keys through internal management. CMEK provides the ability to centrally manage and audit keys using Cloud KMS, fulfilling the requirement of internal control over encryption keys.
- A. Incorrect.
Google-managed encryption keys (default encryption) automatically encrypt data, but you have no control over the encryption keys. This does not meet the requirement of having the keys managed by your internal security team.
- B. Correct.
Customer-managed encryption keys (CMEK) with Cloud KMS allow your internal security team to manage and control the encryption keys through Cloud Key Management Service (KMS). This meets the requirement of managing encryption keys internally.
- C. Incorrect.
Customer-supplied encryption keys (CSEK) allow you to provide your own key, but the management of the key is outside of Google Cloud, which may introduce complexities and does not leverage Cloud KMS.
- D. Incorrect.
Client-side encryption using a third-party library requires you to implement encryption before uploading data to Google Cloud Storage, but this does not integrate with Cloud KMS and is outside the scope of the use case described.