Examkin

Question

Difficulty: Very hardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise is building an analytics platform on Google Cloud that ingests sensitive financial records into BigQuery and stores raw log archives on Compute Engine persistent disks. Security governance requires that all data at rest be protected using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. The security policy mandates strict separation of duties, zero usage of primitive IAM roles, and automated key rotation where legacy data decryptability is preserved without requiring manual re-encryption of historical datasets. Which TWO architectural and IAM configurations must be implemented to fulfill these compliance requirements? (Select TWO)

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) specifically to the Google-managed Service Agents for BigQuery and Compute Engine on the relevant KMS keys.Answer
  2. Configure an automated rotation schedule for the Cloud KMS symmetric encryption key; newly written data will automatically use the updated primary key version while older key versions remain enabled to decrypt historical data.Answer
  3. C
    Pass raw 256-bit AES Customer-Supplied Encryption Keys (CSEK) directly within API request headers to BigQuery and Compute Engine to eliminate reliance on Cloud KMS key management infrastructure.
  4. D
    Grant the primitive Editor role (roles/editor) at the project level to the Compute Engine default service account to ensure it has administrative control to perform on-demand key rotation.

Answer

The enterprise must grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed Service Agents for BigQuery and Compute Engine, and configure an automated key rotation schedule on the Cloud KMS key.
To implement CMEK properly while following GCP security best practices, access to Cloud KMS keys must be granted to the specific Google-managed service agents (e.g., BigQuery service agent) using fine-grained predefined roles like `roles/cloudkms.cryptoKeyEncrypterDecrypter`. Furthermore, Cloud KMS key rotation creates a new primary key version for subsequent write operations while keeping older key versions active, allowing seamlessly transparent decryption of existing historical data without full re-encryption.

Step-by-Step Solution

1
Determine the appropriate key management model and IAM role assignment for GCP service integration.
CMEK requires granting roles/cloudkms.cryptoKeyEncrypterDecrypter to the service agent accounts of BigQuery and Compute Engine rather than using primitive project roles.
Primitive roles violate principle of least privilege and organizational security mandates.
2
Evaluate key rotation mechanisms under Cloud KMS CMEK.
Automated key rotation in Cloud KMS generates new primary key versions for encryption while retaining legacy key versions for decryption.
This allows historical data in BigQuery and persistent disks to remain accessible without requiring data re-encryption.

Key Concept

Cloud KMS Customer-Managed Encryption Keys (CMEK) IAM Service Agent permissions and automated key version rotation management.
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic