Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A multinational e-commerce company is migrating its telemetry processing pipeline to Google Cloud. The architecture requires storing raw telemetry data in Cloud Storage and querying processed datasets in BigQuery. The security compliance team requires that all data at rest be encrypted using keys stored within Google Cloud where key usage is fully audited, while strictly adhering to the principle of least privilege for automated service access. Which configuration strategy should the Cloud Architect recommend?

  1. Configure Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and grant the Cloud Storage and BigQuery service agents the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific encryption key.Answer
  2. B
    Implement Customer-Supplied Encryption Keys (CSEK) by supplying raw 256-bit AES encryption keys in the HTTP headers of every API payload to guarantee full key control.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and grant the Cloud Storage and BigQuery service accounts the Editor primitive role at the project level.
  4. D
    Configure Customer-Managed Encryption Keys (CMEK) in Cloud KMS and rely exclusively on KMS key access permissions to prevent data exfiltration to external buckets.

Answer

Configure Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and grant the Cloud Storage and BigQuery service agents the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific encryption key.
Configuring Customer-Managed Encryption Keys (CMEK) through Cloud KMS provides centralized key management, key rotation capabilities, and full logging of cryptographic operations in Cloud Audit Logs. Granting the predefined role `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud Storage and BigQuery service agents grants only the specific permissions needed to perform encryption and decryption tasks, strictly observing the principle of least privilege.

Step-by-Step Solution

1
Identify the key management requirement
Cloud KMS with Customer-Managed Encryption Keys (CMEK) provides cloud-hosted key management with integrated Cloud Audit Logs.
CMEK allows the organization to control key lifecycle and rotation while leveraging Google Cloud services to manage key storage.
2
Determine least privilege IAM roles for Google Cloud service agents
The Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) should be granted specifically to the Cloud Storage and BigQuery service agents.
Service agents require permission to perform cryptographic operations (encrypt/decrypt) on data objects without gaining administrative control over the key hardware or policies.

Key Concept

Customer-Managed Encryption Keys (CMEK) and Least Privilege IAM for Cloud KMS Service Agents
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic