Examkin

Question

Difficulty: Very hardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise security architect is designing an automated data ingestion pipeline into Google Cloud Storage for a highly regulated financial application. Compliance mandates that all stored customer data must be encrypted at rest using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. The security policy requires strict separation of duties: storage administrators who provision and manage Cloud Storage buckets must not have direct permissions to encrypt or decrypt data or manage encryption keys, whereas automated system services must be granted least-privilege access to perform key operations. Additionally, the setup must support automatic key rotation every 90 days without re-encrypting existing data manually or breaking access to older object versions. Which architecture and identity configuration satisfies these security and operational requirements?

  1. Create a KeyRing and CryptoKey in Cloud KMS with an automated 90-day rotation schedule. Grant the Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the CryptoKey, grant Cloud KMS Admin rights (roles/cloudkms.admin) exclusively to the Security Operations team, and configure the bucket's default KMS key.Answer
  2. B
    Generate customer-supplied key material (CSEK) locally, configure an automated 90-day rotation policy within Cloud KMS, and assign storage administrators the primitive Owner role on the Cloud KMS KeyRing to allow them to bind keys during bucket provisioning.
  3. C
    Grant storage administrators the primitive Editor role on the project to configure bucket CMEK properties, and grant the Cloud Storage service account the Cloud KMS Admin role (roles/cloudkms.admin) so it can generate new key versions during automated key rotation cycles.
  4. D
    Assign the Cloud KMS CryptoKey Encrypter/Decrypter role directly to individual storage administrator user identities while leaving the Cloud Storage service account unprivileged, relying on IAM policy conditions to restrict key usage to approved storage buckets.

Answer

The correct architecture requires creating a Cloud KMS KeyRing and CryptoKey configured with an automated 90-day rotation schedule, granting the Google Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role, restricting Cloud KMS Admin permissions to the Security Operations team, and setting the default CMEK key on the Cloud Storage bucket.
The solution using Cloud KMS CMEK with automated rotation and delegating `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud Storage service account guarantees least privilege and separation of duties. Cloud KMS automatically manages key versions, allowing new writes to use the latest primary key version while keeping older versions active to decrypt existing objects.

Step-by-Step Solution

1
Identify the proper key management model based on compliance requirements.
Cloud KMS with Customer-Managed Encryption Keys (CMEK) satisfies the requirement for central key management in GCP with automated rotation, unlike Customer-Supplied Encryption Keys (CSEK) which require managing key material on-premises and passing raw keys in request headers.
CMEK allows central governance in Cloud KMS while delegating key usage to Google Cloud services.
2
Apply the principle of least privilege and separation of duties for IAM roles.
The Cloud Storage service account ([email protected]) requires `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the specific CryptoKey. Storage administrators must not receive key encrypter/decrypter or key admin permissions.
Cloud Storage acts on behalf of object writers/readers using its own service account to encrypt and decrypt data using the configured CMEK.
3
Configure key rotation lifecycle without manual re-encryption.
Automated key rotation in Cloud KMS creates a new primary key version every 90 days. Existing objects remain encrypted with their original key version, which Cloud KMS retains for decryption requests.
Cloud KMS handles key versioning seamlessly so that existing data decrypted by authorized services does not require manual re-encryption upon key rotation.

Key Concept

Data Encryption at Rest, CMEK, Separation of Duties, and Cloud KMS IAM Roles
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic