Examkin

Question

Difficulty: MediumDeploying and Configuring Cloud Storage Buckets and Objects

A Cloud Engineer must deploy a secure Google Cloud Storage bucket named `fin-secure-records-2026` in the `us-central1` region to store sensitive financial documents. The deployment requires configuring Customer-Managed Encryption Keys (CMEK) using a pre-existing Cloud KMS key, enabling Object Versioning to retain historical file modifications, and populating the bucket with initial record files. What is the correct sequence of steps to configure and populate this Cloud Storage solution using the Google Cloud CLI?

  1. 1Grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) on the designated KMS key.
  2. 2Execute `gcloud storage buckets create gs://fin-secure-records-2026 --location=us-central1 --default-encryption-key=projects/my-project/locations/us-central1/keyRings/fin-ring/cryptoKeys/fin-key` to provision the bucket with CMEK.
  3. 3Execute `gcloud storage buckets update gs://fin-secure-records-2026 --versioning` to enable Object Versioning on the newly created bucket.
  4. 4Execute `gcloud storage cp ./records/* gs://fin-secure-records-2026/` to upload the financial documents into the bucket.

Answer

The correct operational sequence begins by granting the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the KMS key, followed by creating the bucket with the default CMEK key specified, updating the bucket to enable Object Versioning, and finally uploading the files using `gcloud storage cp`.
Configuring CMEK on a Google Cloud Storage bucket requires granting the Cloud Storage service account the `roles/cloudkms.cryptoKeyEncrypterDecrypter` role on the KMS key first. Next, the bucket is provisioned using `gcloud storage buckets create` with the `--default-encryption-key` parameter. Object Versioning is then enabled via `gcloud storage buckets update --versioning`. Finally, files are copied into the fully configured bucket using `gcloud storage cp`.

Step-by-Step Solution

1
Authorize the service account on the encryption key
Cloud Storage Service Agent gains permission to perform encryption/decryption operations with the Cloud KMS key.
If the service agent lacks the CryptoKey Encrypter/Decrypter role prior to bucket setup or object upload, default CMEK bucket operations will fail authorization checks.
2
Provision the Cloud Storage bucket with CMEK
The target bucket `gs://fin-secure-records-2026` is created in `us-central1` with default CMEK settings.
The bucket infrastructure must be created before applying post-creation feature updates or uploading data objects.
3
Enable Object Versioning on the bucket
Object Versioning is active for all future object writes and overwrites.
Enabling versioning after bucket creation ensures that all subsequent upload and modification operations retain version history.
4
Upload objects using `gcloud storage cp`
Files from `./records/*` are copied to `gs://fin-secure-records-2026/` and automatically encrypted with CMEK.
Object ingestion is performed last so that uploaded files inherit both default CMEK encryption and version protection.

Key Concept

Deploying Cloud Storage Buckets with CMEK, Object Versioning, and gcloud storage CLI
Estimated Time:1m 30s
Rate this question

Topics

Deploying and Configuring Cloud Storage Buckets and Objects