Examkin

Question

Difficulty: MediumManaging Encryption Keys with Cloud KMS

An organization requires that sensitive financial audit logs stored in a Cloud Storage bucket in the europe-west1 region be encrypted using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. A cloud engineer creates a Cloud KMS Key Ring named audit-keyring in the us-central1 region and a CryptoKey named audit-key inside it. When attempting to set audit-key as the default encryption key for the europe-west1 Cloud Storage bucket, the command fails. How should the engineer resolve this issue?

  1. Create a new Key Ring in the europe-west1 region and a new CryptoKey inside it, then configure the Cloud Storage bucket to use the new key.Answer
  2. B
    Delete the existing audit-keyring in us-central1 and recreate it with the same name in the europe-west1 region.
  3. C
    Grant the primitive Owner role to the Cloud Storage service agent to allow cross-region key access between us-central1 and europe-west1.
  4. D
    Use the gcloud kms keyrings move command to relocate audit-keyring from us-central1 to europe-west1.

Answer

Create a new Key Ring in the europe-west1 region and a new CryptoKey inside it, then configure the Cloud Storage bucket to use the new key.
Customer-Managed Encryption Keys (CMEK) require that the Cloud KMS Key Ring be created in the exact same location (region or multi-region) as the resource being encrypted (in this case, europe-west1). Because Cloud KMS Key Rings are immutable and cannot be moved or deleted, the engineer must create a new Key Ring in europe-west1.

Step-by-Step Solution

1
Identify location constraint requirements for CMEK integration
Determine that Cloud KMS key rings must reside in the exact same region as the targeted Cloud Storage bucket (europe-west1).
Google Cloud CMEK requires location matching between the storage resource and the KMS Key Ring to maintain regional data locality and latency requirements.
2
Evaluate existing KMS resource management capabilities
Recognize that Cloud KMS Key Rings cannot be deleted, moved, or renamed once created.
Key Rings are permanent resource containers within GCP resource hierarchy.
3
Execute correct deployment workflow
Provision a new Key Ring in europe-west1 and encrypt the Cloud Storage bucket using a CryptoKey created within that new Key Ring.
Creating a new regional Key Ring satisfies both immutability rules and CMEK location matching criteria.

Key Concept

Cloud KMS Key Ring Location Matching and Immutability
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic