Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Match each organizational data security requirement to its corresponding Google Cloud encryption and key management architecture model.

  • Google-default EncryptionData at rest is automatically encrypted using AES-256 with keys managed entirely by Google, requiring no customer configuration or operational management.
  • Customer-Managed Encryption Keys (CMEK)Keys are generated and stored in Cloud KMS, allowing customer control over key lifecycle, IAM access permissions, and automated key rotation.
  • Customer-Supplied Encryption Keys (CSEK)The customer provides a raw 256-bit AES key per API request, holding full responsibility for key storage, with Google using the key only in-memory to perform cryptographic operations.
  • Cloud External Key Manager (Cloud EKM)Encryption key material resides strictly inside a customer-controlled external Hardware Security Module (HSM) located outside Google Cloud infrastructure, with Cloud KMS requesting encrypt/decrypt operations over API.

Answer

Google-default Encryption matches automatic AES-256 encryption managed by Google without configuration. CMEK matches keys generated/stored in Cloud KMS with customer-controlled lifecycle and IAM permissions. CSEK matches customer-supplied raw 256-bit keys provided per API call with no GCP key persistence. Cloud EKM matches key material residing outside GCP in a third-party/on-premises HSM accessed via Cloud KMS.
Each key management tier represents a distinct boundary of operational responsibility and key location: Google-default is fully automated; CMEK stores keys in GCP Cloud KMS with customer-managed IAM/rotation policies; CSEK transiently receives raw customer keys per API call; Cloud EKM keeps master key material inside an external non-GCP HSM.

Step-by-Step Solution

1
Analyze the operational control and key location for Google-default Encryption.
Identified that Google manages key generation, rotation, and storage automatically without customer configuration (matches statement describing default AES-256 with zero setup).
Google-default encryption is enabled out-of-the-box for all GCP storage services.
2
Differentiate CMEK from CSEK based on key persistence and KMS involvement.
CMEK utilizes Cloud KMS within GCP to manage key lifecycles, IAM service agent permissions, and rotation schedules. CSEK requires passing raw key material in API headers directly, retaining zero key material in Cloud KMS.
CMEK delegates storage to Cloud KMS, whereas CSEK keeps key management completely external to GCP and passes key headers transiently.
3
Evaluate the architectural pattern for Cloud EKM.
Cloud EKM connects Cloud KMS to an external physical HSM infrastructure outside of GCP, ensuring the master key material never leaves the external HSM.
Regulatory compliance may mandate physical separation of cryptographic key storage from cloud service providers.

Key Concept

GCP Key Management Spectrum (Default, CMEK, CSEK, Cloud EKM)
Estimated Time:1m 30s
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic