Examkin

Question

Difficulty: EasyManaging Encryption Keys with Cloud KMS

A cloud engineer is managing cryptographic keys in Google Cloud KMS for enterprise data security. Which TWO statements correctly describe key lifecycle management and access permissions for Cloud KMS? (Select TWO)

  1. Cloud KMS key rings and key versions cannot be deleted after creation, but individual key versions can be disabled or scheduled for destruction.Answer
  2. B
    Cloud KMS key rings can be immediately and permanently deleted using gcloud CLI commands to reclaim project resource quotas.
  3. Assigning the predefined Cloud KMS CryptoKey Encrypter/Decrypter role grants a service account the necessary permissions to encrypt and decrypt data.Answer
  4. D
    Granting the primitive Project Owner role is the recommended security best practice for enabling applications to perform routine key encryption operations.
  5. E
    Removing a user's IAM permission on a specific key ring automatically overrides permissions inherited from the parent project level.

Answer

Cloud KMS key rings and key versions cannot be deleted once created (though key versions can be disabled or destroyed), and assigning the predefined Cloud KMS CryptoKey Encrypter/Decrypter role is the recommended approach for granting encryption and decryption capabilities.
In Cloud KMS, key rings and keys cannot be deleted to prevent inadvertent data loss and maintain immutable audit logs; however, individual key versions can be disabled or scheduled for destruction. Additionally, following the principle of least privilege requires assigning dedicated predefined roles—such as Cloud KMS CryptoKey Encrypter/Decrypter—rather than broad primitive roles.

Step-by-Step Solution

1
Evaluate key ring and key version lifecycle rules in Cloud KMS.
Identify that Cloud KMS resources (key rings, keys) cannot be deleted to ensure data recovery auditing, though key material can be scheduled for destruction or disabled.
Google Cloud KMS design prevents accidental key ring deletion which could render encrypted data permanently unrecoverable.
2
Evaluate IAM security best practices for granting cryptographic access.
Determine that specific predefined roles (such as Cloud KMS CryptoKey Encrypter/Decrypter) should be used instead of primitive roles or relying on non-existent lower-level IAM explicit denials.
Predefined roles uphold the principle of least privilege without exposing administrative permissions across the project.

Key Concept

Cloud KMS Key Lifecycle Immutability and Least Privilege IAM Role Assignment
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic