Examkin

Question

Difficulty: Very hardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A multinational financial enterprise is architecting an analytics and data persistence pipeline on Google Cloud using Cloud SQL and BigQuery. Strict regulatory compliance requirements dictate that all data at rest must be encrypted using cryptographic key material that is stored and generated exclusively within the organization's existing on-premises Hardware Security Module (HSM). The security policy strictly prohibits raw key material from ever being stored within Google Cloud infrastructure, yet GCP services must perform automated encryption and decryption operations seamlessly. Additionally, administrative access must follow the principle of least privilege. Which encryption architecture and identity configuration satisfies all compliance and security requirements?

  1. Configure Customer-Managed Encryption Keys (CMEK) backed by Cloud EKM (External Key Manager) to reference external key handles residing in the on-premises HSM, and grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the key to the respective GCP service agents.Answer
  2. B
    Configure Customer-Supplied Encryption Keys (CSEK) by passing raw 256-bit AES key material in API headers to Cloud KMS key rings, allowing GCP service agents to automatically manage decryption operations for Cloud SQL and BigQuery workloads.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) using Cloud EKM, and grant the primitive Owner role (roles/owner) at the project level to the GCP service agents to guarantee key accessibility across all regional endpoints.
  4. D
    Configure standard Cloud KMS CMEK keys generated within Google Cloud HSM, relying solely on IAM roles to prevent raw key material exfiltration without establishing VPC Service Controls or external key managers.

Answer

Configure Customer-Managed Encryption Keys (CMEK) backed by Cloud EKM (External Key Manager) to reference external key handles residing in the on-premises HSM, and grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the key to the respective GCP service agents.
The correct solution uses Customer-Managed Encryption Keys (CMEK) integrated with Cloud EKM (External Key Manager). This setup enables Google Cloud services (such as BigQuery and Cloud SQL) to leverage keys stored in an external, on-premises Hardware Security Module (HSM), keeping key material strictly outside Google Cloud. Furthermore, granting the predefined `roles/cloudkms.cryptoKeyEncrypterDecrypter` role to the specific service agents enforces minimal necessary access permissions.

Step-by-Step Solution

1
Analyze key storage and governance requirements.
The requirement explicitly states key material must be generated and stored exclusively within an on-premises HSM, with raw keys never entering Google Cloud.
Cloud EKM (External Key Manager) is designed specifically to allow Google Cloud services to encrypt/decrypt data using keys held in external key management systems outside GCP.
2
Evaluate service compatibility and integration method.
CMEK integration with Cloud EKM allows services like BigQuery and Cloud SQL to communicate with Cloud KMS, which proxies requests to the external HSM using Cloud EKM.
CSEK is not supported for BigQuery or Cloud SQL, making CMEK via Cloud EKM the required architectural solution.
3
Determine least privilege IAM access model.
GCP service agents for BigQuery and Cloud SQL require permissions to perform encrypter and decrypter operations.
Assigning `roles/cloudkms.cryptoKeyEncrypterDecrypter` directly to the service agent accounts on the specific KMS key enforces the principle of least privilege, avoiding primitive project-level roles.

Key Concept

Cloud EKM with CMEK for On-Premises Key Governance and Least-Privilege Service Agent IAM Roles
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic