Examkin

Question

Difficulty: MediumManaging Encryption Keys with Cloud KMS

An organization is configuring Google Cloud KMS to manage Customer-Managed Encryption Keys (CMEK) for sensitive data stored in Cloud Storage. The security policy mandates strict separation of duties between administrators who manage key policies and workloads that perform cryptographic operations, as well as adherence to standard Cloud KMS key lifecycle management rules. Which of the following configurations and operational practices align with Google Cloud security standards? (Select TWO.)

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the workload service account while granting the Cloud KMS Admin role to key management personnel.Answer
  2. Plan key lifecycle operations around the standard constraint that Cloud KMS Key Rings and CryptoKeys cannot be deleted once created, though individual key versions can be disabled or scheduled for destruction.Answer
  3. C
    Assign the primitive Owner role to security administrators so they can create, manage, and permanently remove obsolete Cloud KMS Key Rings.
  4. D
    Issue a gcloud CLI command to immediately delete empty Cloud KMS Key Rings after retiring an application to reduce resource management overhead.
  5. E
    Attach an explicit Deny policy at the project level to override Cloud KMS Encrypter permissions granted to the service account at the organization level.

Answer

The correct practices are: (1) Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to workload service accounts while assigning the Cloud KMS Admin role to administrators, and (2) Designing key lifecycles around the fact that Cloud KMS Key Rings and CryptoKeys cannot be deleted, but key versions can be disabled or destroyed.
The correct responses recognize the strict separation of duties achieved by separating key administrative roles from key usage roles, as well as the fundamental architectural constraint that Cloud KMS Key Rings and CryptoKeys are immutable and cannot be deleted once created.

Step-by-Step Solution

1
Evaluate role assignment requirements for separation of duties.
Identified that granting Cloud KMS Admin to security personnel and Cloud KMS CryptoKey Encrypter/Decrypter to application service accounts enforces principle of least privilege without over-granting permissions.
Administrators should manage keys without having access to encrypt/decrypt payload data, and workloads should perform crypto operations without permission to alter key rotation or permissions.
2
Review Cloud KMS resource lifecycle rules regarding key deletion.
Confirmed that Key Rings and CryptoKeys are immutable and cannot be deleted from a project once created.
Google Cloud enforces this immutability for cryptographic tracking, audit transparency, and prevention of accidental data loss.

Key Concept

Cloud KMS Separation of Duties and Key Lifecycle Immutability
Estimated Time:1m 30s
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic