Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A healthcare enterprise is deploying virtual machine workloads on Google Compute Engine that process regulated patient data. The enterprise security policy strictly dictates that the organization must retain absolute control over the raw cryptographic key material, ensuring the key is never stored permanently on Google Cloud infrastructure and can be revoked instantly by withholding the key during disk mount operations. Which encryption model should the cloud architect implement for the Compute Engine persistent disks?

  1. Customer-Supplied Encryption Keys (CSEK), where raw AES-256 keys are supplied by the organization for disk creation and attachment operations.Answer
  2. B
    Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS, leveraging automated key rotation schedules managed by Google Cloud.
  3. C
    Google-default encryption using Google-managed keys, providing zero-operational-overhead transparent encryption for all stored data.
  4. D
    Cloud KMS with Customer-Managed Encryption Keys (CMEK), granting the Owner primitive IAM role to the Compute Engine Service Agent.

Answer

Customer-Supplied Encryption Keys (CSEK), where raw AES-256 keys are supplied by the organization for disk creation and attachment operations.
Customer-Supplied Encryption Keys (CSEK) require the user to provide raw 256-bit AES keys directly during API requests to encrypt and decrypt data on persistent disks. Because Google only keeps the key temporarily in memory and never stores raw key material on persistent storage, the organization maintains absolute control over key storage and can revoke access immediately by withholding the key during disk creation or attachment.

Step-by-Step Solution

1
Analyze security requirements
The requirement specifies that raw key material must never be permanently stored on Google Cloud infrastructure and access must be revokable by withholding the key during disk attachment.
Understanding key storage boundaries dictates the choice between Google-managed, CMEK, and CSEK options.
2
Compare GCP key management options
CSEK requires the customer to pass the raw 256-bit AES key in each API call to encrypt/decrypt data, holding the key transiently in memory without persisting it on Google infrastructure. CMEK and Google-default store keys within Cloud KMS or internal Google key repositories.
CSEK is the only encryption model in GCP where raw key material is kept entirely off GCP persistent storage by the customer.
3
Select the compliant solution
Implement Customer-Supplied Encryption Keys (CSEK) for the Compute Engine persistent disks.
CSEK satisfies both raw key ownership and instant revocation via key withholding during mount operations.

Key Concept

Customer-Supplied Encryption Keys (CSEK) vs. Customer-Managed Encryption Keys (CMEK)
Estimated Time:1m 30s
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic