Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise analytics team is configuring a BigQuery data warehouse to store sensitive customer interaction logs. Corporate security policy dictates that data at rest must be encrypted using Customer-Managed Encryption Keys (CMEK) managed in Cloud KMS, with automated key rotation configured every 90 days. To ensure BigQuery can encrypt new table writes and perform background re-encryption following key rotations without violating the principle of least privilege, which configuration action must the security architect perform?

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly to the BigQuery Service Agent service account on the designated encryption key.Answer
  2. B
    Grant the primitive Owner role (roles/owner) to the BigQuery Service Agent on the Cloud KMS KeyRing containing the encryption key.
  3. C
    Generate a raw 256-bit AES Customer-Supplied Encryption Key (CSEK) and pass key headers in every API call so Cloud KMS can perform automatic key rotation.
  4. D
    Define a VPC Service Controls perimeter around Cloud KMS and BigQuery, relying on perimeter ingress rules to grant service access without assigning IAM key permissions.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the BigQuery Service Agent service account on the Cloud KMS key.
Google Cloud services utilizing Customer-Managed Encryption Keys (CMEK) authenticate key access via service agents. Granting the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the BigQuery Service Agent enables BigQuery to encrypt new data and re-encrypt existing tables upon key rotation while adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the service account required for Google Cloud service integrations using CMEK.
BigQuery uses its dedicated service agent account ([email protected]) to access KMS keys.
Service agents handle backend service interactions like table encryption and background key re-encryption.
2
Determine the minimal IAM role required for key usage.
The Cloud KMS CryptoKey Encrypter/Decrypter role provides encryption and decryption permissions needed for data protection without administrative rights.
Applying fine-grained predefined roles satisfies least privilege security policy requirements.

Key Concept

CMEK Service Agent Authorization and Cloud KMS IAM Roles
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic