Examkin

Question

Difficulty: EasyData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An organization is deploying an application on Google Cloud and needs to configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS to protect sensitive data stored in Cloud Storage buckets and Compute Engine persistent disks. Which TWO requirements must be met to properly implement CMEK for these services? (Select TWO)

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the KMS key to the Google-managed service account for each respective GCP service.Answer
  2. B
    Upload raw 256-bit AES symmetric keys directly through the gcloud CLI during resource creation to allow Cloud KMS to manage key decryption.
  3. Specify the Cloud KMS key resource ID when creating the Cloud Storage bucket or Compute Engine persistent disk.Answer
  4. D
    Assign the primitive Owner role on the Cloud KMS project to the Compute Engine default service account to ensure cryptographic access.

Answer

The correct requirements are granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed service accounts for Cloud Storage and Compute Engine, and referencing the Cloud KMS key resource ID during resource creation.
Implementing CMEK for GCP resources requires providing the Cloud KMS key resource ID to the target service (such as Cloud Storage or Compute Engine) and granting the specific service agent the Cloud KMS CryptoKey Encrypter/Decrypter role so it can perform encryption/decryption operations.

Step-by-Step Solution

1
Identify the key management model being requested.
The scenario specifically asks for Customer-Managed Encryption Keys (CMEK) using Cloud KMS.
CMEK relies on keys hosted inside Google Cloud KMS rather than key material generated and supplied out-of-band by the customer in API requests.
2
Determine IAM permission requirements for GCP service integration.
GCP services use dedicated service agents to interact with Cloud KMS keys.
The service agents require the minimal predefined role 'roles/cloudkms.cryptoKeyEncrypterDecrypter' on the targeted CryptoKey.
3
Determine resource binding requirements.
Resources must be explicitly configured with the Cloud KMS key URI upon creation.
Providing the key resource ID instructs Google Cloud to encrypt new objects or persistent disks using the specified CMEK key.

Key Concept

Customer-Managed Encryption Keys (CMEK) and Service Agent IAM Configuration
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic