Examkin

Question

Difficulty: HardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A healthcare organization is migrating an on-premises PostgreSQL database to Cloud SQL. Corporate governance mandates that all encryption keys protecting sensitive patient records must reside strictly within an on-premises physical Hardware Security Module (HSM) outside of Google Cloud. Additionally, key access must follow the principle of least privilege, granting permission only to the necessary service identity. Which key management architecture and IAM configuration meets these regulatory requirements?

  1. Configure Cloud SQL to use Customer-Managed Encryption Keys (CMEK) integrated with Cloud EKM pointing to the on-premises HSM, and grant the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.Answer
  2. B
    Implement Customer-Supplied Encryption Keys (CSEK) by embedding raw 256-bit AES key material directly into the Cloud SQL database connection strings and deployment configurations.
  3. C
    Configure Cloud SQL to use Customer-Managed Encryption Keys (CMEK) backed by Cloud KMS, and grant the Project Owner primitive role to the Cloud SQL service account to guarantee persistent key access during automatic key rotations.
  4. D
    Deploy Cloud SQL using Google-default encryption keys and configure VPC Service Controls perimeters to handle external key encryption automatically for database persistent disks.

Answer

Configure Cloud SQL with CMEK integrated with Cloud EKM pointing to the on-premises HSM, and assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud SQL Service Agent.
Customer-Managed Encryption Keys (CMEK) integrated with Cloud EKM (External Key Manager) allow Google Cloud services like Cloud SQL to perform data encryption and decryption while holding the root cryptographic keys within an external, on-premises Hardware Security Module (HSM). Granting the Cloud KMS CryptoKey Encrypter/Decrypter role strictly to the Cloud SQL Service Agent satisfies least-privilege security requirements.

Step-by-Step Solution

1
Analyze key storage location requirements
Identified that keys must physically reside inside an on-premises HSM, requiring Cloud External Key Manager (Cloud EKM).
Cloud EKM allows Google Cloud services to protect data at rest using keys stored in supported external key management systems outside Google infrastructure.
2
Evaluate service compatibility with key management options
Selected CMEK combined with Cloud EKM for Cloud SQL.
Cloud SQL supports CMEK with Cloud KMS and Cloud EKM, whereas Customer-Supplied Encryption Keys (CSEK) are not supported on Cloud SQL.
3
Determine appropriate Identity and Access Management (IAM) role
Granted the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud SQL Service Agent.
Assigning predefined fine-grained roles to the specific service agent enforces least privilege, avoiding over-privileged primitive roles like Owner or Editor.

Key Concept

Cloud EKM with CMEK for external key sovereignty and fine-grained Cloud KMS IAM roles
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic