Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A healthcare organization is migrating an operational telemetry application to Google Cloud. The architecture uses Compute Engine persistent disks for temporary cache storage and Cloud Storage for long-term log archiving. Security compliance mandates that all data at rest be encrypted using keys generated and protected inside FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs) in Google Cloud, while supporting automated key rotation. Furthermore, key access control must strictly adhere to the principle of least privilege without relying on broad administrative roles. Which TWO configuration steps should the security architect implement to meet these requirements? (Select TWO.)

  1. Provision Customer-Managed Encryption Keys (CMEK) in Cloud KMS configured with the HSM protection level, and define an automated key rotation schedule on the CryptoKey.Answer
  2. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud Storage Service Agent and Compute Engine Service Agent identity accounts.Answer
  3. C
    Implement Customer-Supplied Encryption Keys (CSEK) for both services so that Google Cloud KMS automatically rotates the raw key material on a scheduled basis.
  4. D
    Assign the primitive Editor role to the default service accounts of Compute Engine and Cloud Storage to permit full encryption key access across the project.

Answer

The architect should configure Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM with automated rotation schedules, and grant the Cloud KMS CryptoKey Encrypter/Decrypter role directly to the Cloud Storage and Compute Engine Service Agents.
Provisioning CMEK backed by Cloud HSM meets the FIPS 140-2 Level 3 hardware security constraint and enables automated key rotation directly through Cloud KMS. Granting the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud Storage Service Agent and Compute Engine Service Agent grants the precise permissions needed by GCP services to perform cryptographic operations on behalf of the user, adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify key storage and compliance requirements
Requirements specify FIPS 140-2 Level 3 HSM key protection and automated key rotation within Google Cloud.
Cloud KMS with the HSM protection level (Cloud HSM) satisfies hardware security requirements while allowing automated rotation.
2
Determine appropriate service access permissions for encryption
GCP service agents require granular permissions to encrypt and decrypt resources using the specified CMEK key.
Granting `roles/cloudkms.cryptoKeyEncrypterDecrypter` to specific service agents follows least-privilege practices without using primitive roles.

Key Concept

CMEK with Cloud HSM and IAM Service Agent Least Privilege
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic