Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise is designing a real-time telemetry processing pipeline on Google Cloud using Cloud Pub/Sub. Internal compliance standards require that message data stored at rest within Cloud Pub/Sub topics must be encrypted using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. The security team strictly mandates separation of duties and least privilege access. Which TWO configuration steps must you perform to encrypt the Cloud Pub/Sub topic with CMEK? (Select TWO.)

  1. Create a Cloud KMS Symmetric Encryption key in the location matching the Pub/Sub topic, and specify the key resource ID during topic creation.Answer
  2. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the Google-managed Cloud Pub/Sub Service Agent service account.Answer
  3. C
    Generate a raw 256-bit AES key on-premises and pass it in HTTP request headers as a Customer-Supplied Encryption Key (CSEK) when publishing messages.
  4. D
    Assign the primitive Editor role on the Cloud KMS KeyRing to the default Compute Engine service account to allow automated key rotation.

Answer

The required setup involves creating a symmetric Cloud KMS key in the same geographic location as the topic and referencing its resource ID, while assigning the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed Cloud Pub/Sub Service Agent service account.
To configure CMEK on a Cloud Pub/Sub topic, you must create a Cloud KMS key in a matching location and attach its key resource ID to the topic. In addition, Google Cloud Pub/Sub accesses keys using its Google-managed Service Agent, which must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role.

Step-by-Step Solution

1
Determine the required encryption key model.
The requirement specifies CMEK (Cloud KMS managed key lifecycle) rather than CSEK (customer-supplied raw key headers).
CMEK allows central lifecycle management, auditability, and integration with GCP native services.
2
Identify the principal conducting key operations.
Cloud Pub/Sub utilizes a Google-managed Service Agent ([email protected]).
Granting roles/cloudkms.cryptoKeyEncrypterDecrypter to the Service Agent enforces separation of duties so end users and compute workloads do not need direct key decryption permissions.
3
Ensure resource location alignment.
The Cloud KMS KeyRing and CryptoKey must exist in the same region or multi-region as the Cloud Pub/Sub topic.
GCP mandates location matching for CMEK resources to prevent cross-region latency and regulatory non-compliance.

Key Concept

Configuring CMEK for Google Cloud services requires granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the service's Google-managed Service Agent while matching resource and key locations.
Estimated Time:2m 0s
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic