A security team alerts a cloud administrator that a specific version of a Cloud KMS CryptoKey used for encrypting database backups may have been exposed. The administrator must quickly stop any new data from being encrypted with the compromised key version while retaining the ability to decrypt existing backups. Additionally, the organization wants to comply with Cloud KMS resource lifecycle constraints. Which two actions should the administrator take to resolve this security incident? (Select TWO)
- Disable the compromised key version and set a new, uncompromised key version as the primary key version for the CryptoKey.Answer
- Retain the KeyRing and CryptoKey resource metadata in Google Cloud, recognizing that Cloud KMS KeyRings and CryptoKeys cannot be deleted once created.Answer
- CIssue a command to permanently delete the entire KeyRing resource from the GCP project to immediately purge all associated keys and metadata.
- DGrant the primitive Owner role to the automated backup service account to allow it to bypass key state checks and overwrite the key state.
- ERevoke the Cloud KMS Encrypter role at the resource level while leaving it assigned at the organization level, expecting resource-level revocation to deny inherited access.
Answer
The administrator should disable the compromised key version while creating a new primary version for new encryptions, and recognize that KeyRing and CryptoKey metadata resources cannot be deleted in Cloud KMS.
Disabling the affected CryptoKey version prevents any service from using it to encrypt new data while preserving decrypt capabilities when re-enabled. Setting a new primary version ensures seamless transition for ongoing encryption. Furthermore, Cloud KMS enforces immutability on KeyRing and CryptoKey objects, meaning these administrative containers cannot be deleted.
Step-by-Step Solution
Key Concept
Cloud KMS Key Lifecycle Management and KeyRing Immutability