Google Professional Data Engineer Question 9
Select 3Google Cloud PlatformYou are designing a data pipeline in Google Cloud to process sensitive customer information. To comply with regulatory requirements, all data stored in Google Cloud Storage must be encrypted using a customer-managed encryption key (CMEK). Additionally, you need to ensure that unauthorized access to the encryption key is prevented. Which steps should you take to meet these requirements?
- A
Enable CMEK for the Cloud Storage bucket and configure it to use a key stored in Cloud Key Management Service (Cloud KMS).
- B
Grant 'roles/cloudkms.cryptoKeyEncrypterDecrypter' IAM role on the encryption key to the storage bucket's service account.
- C
Restrict access to the encryption key by using IAM policies to allow only specific users or service accounts.
- D
Disable default encryption on the Cloud Storage bucket, as it conflicts with CMEK.
- E
Rotate the encryption key periodically in Cloud KMS to enhance security.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet data security requirements for sensitive customer information, you should use CMEK with Cloud KMS, restrict access to the encryption key using IAM policies, and periodically rotate the key to ensure compliance and enhance security. Granting too broad access to the encryption key or misunderstanding default encryption settings could lead to non-compliance or security risks.
- A. Correct.
Correct: Enabling CMEK and using Cloud KMS for key management ensures that you meet the requirement for customer-managed encryption keys.
- B. Incorrect.
Incorrect: Granting the 'roles/cloudkms.cryptoKeyEncrypterDecrypter' role to the storage bucket's service account would allow unauthorized services to access the key, which does not comply with the requirement to prevent unauthorized access.
- C. Correct.
Correct: Restricting access to the encryption key using IAM policies ensures that only authorized users or services can manage or use the key.
- D. Incorrect.
Incorrect: Default encryption does not conflict with CMEK; instead, CMEK overrides the default encryption settings when configured.
- E. Correct.
Correct: Rotating the encryption key periodically is a best practice that enhances security and complies with many regulatory requirements.