Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Match each Google Cloud data encryption and key management mechanism to its defining operational control and key lifecycle characteristic.

  • Google-default EncryptionKeys are fully generated, managed, and rotated by Google at rest with no customer configuration required.
  • Customer-Managed Encryption Keys (CMEK)Keys are managed in Cloud KMS or Cloud HSM by the customer, allowing automated rotation and granular IAM permission delegation to GCP service agents.
  • Customer-Supplied Encryption Keys (CSEK)Raw AES-256 keys are provided directly by the client within individual API headers, kept strictly in-memory during operation, and never stored on Google disks.
  • Cloud External Key Manager (Cloud EKM)Keys reside in an external, customer-managed third-party Hardware Security Module (HSM) outside Google Cloud infrastructure, evaluated per request over a secure API.

Answer

Google-default Encryption maps to automatic key lifecycle management by Google. Customer-Managed Encryption Keys (CMEK) maps to key control in Cloud KMS/HSM with automated rotation and IAM access configuration. Customer-Supplied Encryption Keys (CSEK) maps to supplying raw AES-256 keys in API calls held only in memory. Cloud External Key Manager (Cloud EKM) maps to holding keys in an external third-party HSM outside of Google Cloud.
Each encryption mechanism corresponds to a distinct tier of key custody: Google-default handles all keys automatically; CMEK grants customers control of keys stored within Cloud KMS/HSM; CSEK requires callers to supply raw keys in each API call; and Cloud EKM anchors key protection to an external HSM residing outside Google Cloud.

Step-by-Step Solution

1
Analyze key ownership and control requirements for each GCP encryption tier.
Differentiate between fully managed (Google-default), cloud-hosted customer control (CMEK/Cloud KMS), ephemeral client-provided keys (CSEK), and off-cloud external keys (Cloud EKM).
Understanding key placement and request mechanisms determines regulatory compliance and operational responsibility.
2
Pair client API header requirements with Customer-Supplied Encryption Keys (CSEK).
Confirm that CSEK requires transmitting raw AES-256 keys per API request without Google storing the key to disk.
CSEK is unique in requiring per-request key transmission without persisting the key within any Google service.
3
Pair third-party external HSM requirements with Cloud EKM.
Confirm that Cloud EKM routes key operation requests outside GCP to external key managers.
Cloud EKM ensures data keys never leave the external HSM boundary while integrating with GCP services.

Key Concept

Selecting data encryption key modes across Google-default, CMEK, CSEK, and EKM based on regulatory governance and operational requirements.
Estimated Time:1m 30s
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic