Examkin

Question

Difficulty: HardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A financial enterprise processes sensitive analytical records in BigQuery and archives raw log files in Cloud Storage. Enterprise compliance guidelines specify three mandatory controls:
1. Key Management: Data at rest must be encrypted using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS to support automated key rotation.
2. Access Governance: Key access must follow the principle of least privilege using predefined IAM roles assigned to dedicated service agents without granting administrative privileges.
3. Perimeter Protection: Data exfiltration must be strictly prevented so that authorized identity credentials cannot copy data to external Cloud Storage buckets outside the organizational boundary.

Which TWO configurations must the security architect implement to fulfill these compliance requirements?

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the Cloud KMS key to the service agents for Cloud Storage and BigQuery.Answer
  2. Configure a VPC Service Controls security perimeter that encompasses the BigQuery and Cloud Storage projects.Answer
  3. C
    Supply raw 256-bit AES customer-supplied encryption keys (CSEK) in API request headers for all storage write calls.
  4. D
    Grant the Owner primitive IAM role on the Cloud KMS KeyRing to the application service accounts to allow automated key operations.

Answer

The architect must grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the BigQuery and Cloud Storage service agents and configure a VPC Service Controls security perimeter around the projects.
To satisfy CMEK requirements under least privilege, GCP service agents (such as service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) must be granted the dedicated predefined role `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key. Additionally, guarding against data exfiltration even when users hold valid IAM privileges requires a network-level boundary via VPC Service Controls surrounding the storage and analytics services.

Step-by-Step Solution

1
Identify the key management and service access requirements for CMEK.
Cloud Storage and BigQuery require key usage permissions through their respective service agents (service accounts managed by Google Cloud).
Granting the predefined Cloud KMS CryptoKey Encrypter/Decrypter role directly to the service agents ensures cryptographic operations succeed while following least privilege.
2
Address the data exfiltration prevention requirement.
Deploying VPC Service Controls perimeters restricts egress of data across GCP API boundaries.
IAM permissions control WHO has access, whereas VPC Service Controls enforce WHERE data can go, preventing authorized users from copying data outside the perimeter.

Key Concept

Cloud KMS CMEK integration with GCP Service Agents and exfiltration defense via VPC Service Controls
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic