Examkin

Question

Difficulty: HardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise security architect is defining key management and data encryption standards across Google Cloud infrastructure to satisfy distinct regulatory guidelines. Match each compliance and operational key control requirement to its corresponding Google Cloud encryption mechanism.

  • Data must be encrypted at rest using keys hosted on an on-premises Hardware Security Module (HSM), ensuring Google Cloud never stores or directly accesses unencrypted root key material, with cryptographic requests routed externally over private network connections.Cloud External Key Manager (Cloud EKM)
  • Data must be protected using customer-controlled cryptographic keys hosted in Google Cloud, supporting automated key rotation schedules, fine-grained IAM access control, and FIPS 140-2 Level 3 HSM hardware protection.Customer-Managed Encryption Keys (CMEK) via Cloud KMS / Cloud HSM
  • Transient compute workloads require per-request encryption key material supplied directly in API calls for disk operations, where key material resides only in ephemeral memory and is never retained in GCP persistent storage.Customer-Supplied Encryption Keys (CSEK)
  • Data resting in cloud storage services must be protected by default using symmetric AES-256 encryption without requiring custom key creation, IAM role assignments, or operational key management overhead.Google-Default Encryption

Answer

Cloud EKM matches external on-premises HSM key hosting; CMEK via Cloud KMS/HSM matches in-cloud customer-controlled key lifecycle and rotation management; CSEK matches raw per-request key material held only in transient memory; Google-Default Encryption matches automated zero-overhead baseline storage encryption.
Each key control requirement maps to a specific GCP encryption model based on key ownership location and operational burden: Cloud EKM protects data with keys residing outside GCP; CMEK offers native GCP KMS lifecycle management; CSEK processes ephemeral client-provided keys per call; and Google-Default handles transparent baseline storage encryption.

Step-by-Step Solution

1
Analyze external on-premises key retention requirements.
Identify that Cloud External Key Manager (Cloud EKM) routes cryptographic requests to keys hosted outside GCP boundaries.
Cloud EKM connects GCP services to external HSM systems so root keys never leave on-premises infrastructure.
2
Evaluate requirements for customer-managed key lifecycle and rotation within Google Cloud.
Match with Customer-Managed Encryption Keys (CMEK) using Cloud KMS or Cloud HSM.
CMEK gives full control over rotation schedules, IAM policy permissions, and location while running on Google Cloud managed infrastructure.
3
Assess transient per-request key header requirements.
Match with Customer-Supplied Encryption Keys (CSEK).
CSEK accepts user-supplied key material in API request headers without storing the keys anywhere in Google Cloud persistent storage.
4
Identify default baseline platform encryption requirements.
Match with Google-Default Encryption.
Google Cloud automatically encrypts all data at rest using AES-256 standard encryption without requiring manual key management.

Key Concept

Google Cloud Data Encryption Spectrum (Google-Default, CMEK, CSEK, Cloud EKM)
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic