Examkin

Question

Difficulty: HardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise is migrating sensitive operational audit logs to Google Cloud. The compliance framework mandates that data stored at rest in Cloud Storage buckets and BigQuery datasets must be encrypted using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS. The security team mandates strict separation of duties: storage administrators must not manage encryption keys, and key administrators must not access stored log data. Additionally, key rotation must occur automatically without requiring manual re-encryption of existing historical data. Which TWO architectural configuration steps must you perform to meet these requirements? (Select TWO)

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the Cloud Storage and BigQuery service agents, ensuring key management permissions remain restricted to the security team.Answer
  2. Configure an automated rotation schedule on the Cloud KMS CryptoKey so that new key versions are generated periodically while older key versions remain available for decryption.Answer
  3. C
    Implement Customer-Supplied Encryption Keys (CSEK) by providing raw 256-bit AES keys with each API request to automate key lifecycle management across GCP services.
  4. D
    Grant the primitive Owner role on the Cloud KMS KeyRing to the Cloud Storage and BigQuery service accounts so they can manage key creation and rotation directly.

Answer

Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed service agents enforces separation of duties, and configuring an automated key rotation schedule on the Cloud KMS CryptoKey ensures seamless encryption of new data while preserving access to historical data.
Granting the Cloud KMS CryptoKey Encrypter/Decrypter role directly to service agents ensures strict separation of duties and least privilege compliance. Furthermore, setting up an automated key rotation schedule on the Cloud KMS CryptoKey allows GCP services to use the latest key version for new writes while retaining older versions to read legacy data without manual re-encryption.

Step-by-Step Solution

1
Identify key management and separation of duties requirements for CMEK.
Determine that service agents require cryptographic access via fine-grained roles rather than primitive permissions.
Google Cloud service agents (e.g., BigQuery and Cloud Storage service accounts) perform encryption and decryption on behalf of users when configured with CMEK.
2
Configure IAM permissions using least privilege.
Grant roles/cloudkms.cryptoKeyEncrypterDecrypter on the key to the service agents.
This allows the service agents to encrypt/decrypt data without granting human administrators cross-domain access.
3
Configure key rotation settings in Cloud KMS.
Enable automated rotation schedules on the Cloud KMS CryptoKey.
Cloud KMS automatically uses the new primary key version for encrypting newly written data while maintaining old versions for decrypting existing data.

Key Concept

Customer-Managed Encryption Keys (CMEK) and IAM Separation of Duties in Cloud KMS
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic