Examkin

Question

Difficulty: HardManaging Encryption Keys with Cloud KMS

A cloud engineer is configuring customer-managed encryption keys (CMEK) in Google Cloud KMS for a sensitive Cloud Storage bucket residing in the us-central1 region. The organization requires strict separation of duties: security administrators must manage keys and IAM policies without being able to encrypt or decrypt data, whereas the Cloud Storage service account requires permissions solely to perform cryptographic encryption and decryption operations. Additionally, an operator asks to permanently delete an outdated Cloud KMS Key Ring to clean up resources. Which configuration correctly satisfies these requirements while adhering to Google Cloud KMS operational capabilities?

  1. Grant security administrators the Cloud KMS Admin role, assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the service account on the key, and explain that Key Rings cannot be deleted once created in Cloud KMS.Answer
  2. B
    Grant security administrators the Cloud KMS Admin role, assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the service account, and run a gcloud command to immediately delete the outdated Key Ring and its keys.
  3. C
    Grant security administrators the primitive Editor role for full Cloud KMS management capability, and assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.
  4. D
    Assign the Cloud KMS CryptoKey Encrypter/Decrypter role at the Organization level to ensure all service accounts inherit key access, and assign the Owner role to security administrators to oversee key management.

Answer

Assign the Cloud KMS Admin role to security administrators, grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the service account, and explain that Key Rings cannot be deleted once created in Cloud KMS.
Separation of duties in Cloud KMS is enforced by combining predefined roles. The Cloud KMS Admin role permits management of keys and IAM policies without granting encrypt/decrypt data access. The Cloud KMS CryptoKey Encrypter/Decrypter role allows workload service accounts to perform cryptographic operations on data. Additionally, Google Cloud KMS enforces immutability for Key Rings and CryptoKeys—they cannot be deleted once created.

Step-by-Step Solution

1
Evaluate separation of duties for IAM roles
Cloud KMS Admin (`roles/cloudkms.admin`) allows managing key rings, keys, and IAM policies, but explicitly lacks permissions to encrypt or decrypt data (`cloudkms.cryptoKeyVersions.useToEncrypt`/`useToDecrypt`), ensuring administrative duties are isolated from data access.
Security policy requires administrators to manage keys without being capable of viewing or decrypting payload data.
2
Assign cryptographic permissions to the workload service account
The Cloud KMS CryptoKey Encrypter/Decrypter role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) gives the Cloud Storage service account necessary rights to use the key for CMEK operations without granting administrative access.
Service accounts integrating with CMEK require explicit permission to perform cryptographic operations.
3
Analyze key ring lifecycle operations and limitations
Cloud KMS resources, specifically Key Rings and CryptoKeys, are permanent entities once created to prevent data loss and ensure audit trail integrity; they cannot be deleted.
Google Cloud KMS design mandates that key names and key ring resource paths remain permanent in GCP project history.

Key Concept

Cloud KMS Separation of Duties and Key Lifecycle Governance
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic