Examkin

Question

Difficulty: EasyManaging Encryption Keys with Cloud KMS

An organization requires that encryption keys stored in Google Cloud KMS are regularly rotated every 90 days to comply with security policies. The security team wants to ensure that newly written data uses the newest key version while previously encrypted data remains decryptable without manual re-encryption. Which configuration approach should you use in Cloud KMS?

  1. Configure an automated key rotation schedule with a 90-day rotation period on the target CryptoKey.Answer
  2. B
    Delete the existing Key Ring every 90 days and recreate a new Key Ring with a new CryptoKey.
  3. C
    Assign the primitive Owner role to an automated script to destroy old key versions every 90 days.
  4. D
    Grant IAM permissions at the Organization level so resource hierarchy inheritance automatically rotates keys across all sub-projects.

Answer

Configure an automated key rotation schedule with a 90-day rotation period on the target CryptoKey.
Configuring an automated key rotation schedule directly on the CryptoKey allows Google Cloud KMS to generate a new primary key version automatically every 90 days. New encryption operations use the active primary version, while older key versions remain available so existing data can still be decrypted.

Step-by-Step Solution

1
Identify the core requirement for Cloud KMS key management.
The requirement is to rotate key versions automatically every 90 days while preserving decryption capabilities for existing data.
Security compliance requires periodic key rotation, but older key versions must remain available to read existing encrypted datasets.
2
Evaluate Google Cloud KMS native key rotation capabilities.
Setting an automated rotation schedule on the CryptoKey generates new primary key versions on a schedule while keeping past versions active for decryption.
Cloud KMS supports setting a rotation period and next rotation time directly on the CryptoKey resource.

Key Concept

Cloud KMS CryptoKey Automated Key Rotation
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic