Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise logistics company plans to store sensitive customer shipment records in Cloud Storage and analyze them using BigQuery. Security compliance mandates that the data must be protected at rest using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. The security team requires strict adherence to least privilege, explicit separation of duties, and continuous compliance automation without giving service accounts administrative key control. Which TWO architectural design decisions and IAM configurations should you implement to meet these requirements?

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific Cloud KMS key to the service agents for Cloud Storage and BigQuery.Answer
  2. Enable automated key rotation schedules on the Cloud KMS CryptoKey used by Cloud Storage and BigQuery.Answer
  3. C
    Assign the primitive Owner role to the Cloud Storage service account to permit dynamic generation and management of Customer-Supplied Encryption Keys (CSEK).
  4. D
    Configure Customer-Supplied Encryption Keys (CSEK) for BigQuery to satisfy automated key lifecycle and rotation governance directly within Google Cloud.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the GCP service agents for Cloud Storage and BigQuery, and enable automated key rotation schedules on the Cloud KMS key.
Configuring CMEK via Cloud KMS with automated key rotation and granting the Cloud KMS CryptoKey Encrypter/Decrypter role to service agents fulfills all enterprise compliance requirements for key management, separation of duties, and least privilege access.

Step-by-Step Solution

1
Identify key management requirements for Cloud Storage and BigQuery CMEK.
Cloud Storage and BigQuery both support CMEK integrated with Cloud KMS.
CMEK allows central management of encryption keys within Cloud KMS while delegating cryptographic operations to Google Cloud service agents.
2
Apply least privilege and separation of duties for Cloud KMS permissions.
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the service agents.
Service agents require encryption/decryption permissions on the key, but should not have admin roles (`roles/cloudkms.admin`) or primitive permissions (`roles/owner`).
3
Configure key rotation according to compliance policy.
Enable automated key rotation in Cloud KMS.
Cloud KMS handles key rotation automatically, generating new key versions while keeping older versions active for decryption of existing data blocks.

Key Concept

Customer-Managed Encryption Keys (CMEK) and IAM Separation of Duties in Cloud KMS
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic