Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A regulatory authority requires a financial institution to store highly sensitive customer audit logs in BigQuery. The institution's strict governance policy dictates that the cryptographic root of trust must reside exclusively within an on-premises Hardware Security Module (HSM) outside Google Cloud, ensuring Google never holds raw key material at rest. Which architectural configuration meets these regulatory compliance requirements while adhering to Google Cloud security best practices?

  1. Configure BigQuery table encryption using Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM), and grant the BigQuery Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.Answer
  2. B
    Implement Customer-Supplied Encryption Keys (CSEK) for BigQuery by passing the raw on-premises HSM key directly in the request headers of every API call.
  3. C
    Configure BigQuery CMEK with Cloud EKM and grant the primitive Owner role to the BigQuery Service Agent on the target Cloud KMS key ring.
  4. D
    Utilize default Google-managed encryption keys for BigQuery tables while placing the dataset inside a VPC Service Controls security perimeter to prevent unauthorized data access.

Answer

Configure BigQuery table encryption using Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM), and grant the BigQuery Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.
Cloud External Key Manager (Cloud EKM) allows Google Cloud services like BigQuery to encrypt data using keys stored in an external, on-premises Key Management Partner or HSM. By configuring CMEK pointed at a Cloud EKM key reference and granting the BigQuery service agent the minimal `roles/cloudkms.cryptoKeyEncrypterDecrypter` role, the organization maintains external key control while maintaining least-privilege security standards.

Step-by-Step Solution

1
Identify the key management and external custody requirements.
The requirement mandates external key custody in an on-premises HSM, ensuring Google Cloud never holds raw key material at rest.
Cloud External Key Manager (Cloud EKM) is the GCP solution designed to integrate GCP services with external Key Management Partners / external HSMs.
2
Evaluate service compatibility and key configuration mode.
BigQuery supports CMEK backed by Cloud KMS keys that point to Cloud EKM.
Customer-Supplied Encryption Keys (CSEK) are unsupported for BigQuery and would involve sending raw keys into GCP RAM.
3
Determine necessary IAM permissions for the BigQuery service agent.
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the Cloud KMS key reference to the BigQuery service account.
This grants minimum required operational access without granting primitive administrative permissions (`roles/owner`).

Key Concept

Cloud External Key Manager (Cloud EKM) and CMEK Integration
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic