Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A cloud security architect is defining data protection standards across several enterprise applications migrating to Google Cloud. Match each business or regulatory requirement to the appropriate Google Cloud key management or encryption model.

  • The organization must generate and retain key material in an on-premises external key management system outside of GCP, authorizing GCP to request cryptographic operations over an API.Cloud External Key Manager (Cloud EKM)
  • The organization requires key material to be stored in FIPS 140-2 Level 3 validated Hardware Security Modules hosted inside GCP, while maintaining customer control over key rotation schedules and IAM permissions.Customer-Managed Encryption Keys (CMEK) via Cloud HSM
  • Compliance demands that raw 256-bit AES encryption keys are provided directly in API calls for persistent disk encryption and discarded from GCP memory after use, without key persistence in GCP.Customer-Supplied Encryption Keys (CSEK)
  • The system requires baseline data encryption at rest with zero administrative overhead, where Google automatically manages key generation, storage, and rotation.Google-default Encryption

Answer

Matching pairings: External key generation and retention outside GCP maps to Cloud External Key Manager (Cloud EKM); FIPS 140-2 Level 3 HSM hosted in GCP under customer control maps to Customer-Managed Encryption Keys (CMEK) via Cloud HSM; Transient per-request raw key delivery maps to Customer-Supplied Encryption Keys (CSEK); Zero-overhead automatic encryption by Google maps to Google-default Encryption.
Each requirement aligns directly with its underlying GCP cryptographic architecture: external key custody maps to Cloud EKM; Google-hosted FIPS 140-2 Level 3 hardware key management maps to CMEK with Cloud HSM; transient per-request key transmission maps to CSEK; and default automated protection maps to Google-default encryption.

Step-by-Step Solution

1
Identify key location and custody requirements for external systems
Keys residing in on-premises/third-party HSMs outside GCP infrastructure correspond to Cloud External Key Manager (Cloud EKM).
Cloud EKM connects GCP services to external key management infrastructure via HTTPS endpoints.
2
Evaluate hardware security and administrative compliance levels inside GCP
Keys requiring FIPS 140-2 Level 3 hardware validation managed via Cloud KMS policies map to CMEK with Cloud HSM.
Cloud HSM is a Google-managed hardware security module service integrated into Cloud KMS.
3
Determine key handling for raw per-request key supply
Passing raw 256-bit AES keys directly in service API calls without storing keys in Cloud KMS maps to CSEK.
CSEK requires callers to supply the raw cryptographic key in header parameters for each storage or disk API call.
4
Assess baseline default encryption behavior
Default automatic encryption using internal Google key management systems maps to Google-default Encryption.
All GCP data at rest is encrypted by default using AES-256 without customer setup.

Key Concept

Selecting appropriate GCP encryption models (Google-default, CMEK, CSEK, Cloud EKM) based on operational, regulatory, and key custody requirements.
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic