Examkin

Question

Difficulty: EasyData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Match each Google Cloud data encryption mechanism on the left with its defining key management characteristic on the right.

  • Google-default EncryptionGoogle automatically generates and manages keys with no customer intervention required.
  • Customer-Managed Encryption Keys (CMEK)Keys are stored in Cloud KMS, allowing customers to control rotation schedules and IAM access permissions.
  • Customer-Supplied Encryption Keys (CSEK)Raw AES-256 keys are provided in API call headers and reside in volatile RAM only during request processing.
  • Cloud External Key Manager (Cloud EKM)Keys reside in an external third-party hardware security module (HSM) located outside of Google Cloud.

Answer

Google-default Encryption matches automatic key management by Google; CMEK matches storing keys in Cloud KMS with customer rotation and IAM control; CSEK matches supplying raw AES-256 keys in API headers; Cloud EKM matches keeping encryption keys in an external third-party HSM outside Google Cloud.
Each encryption mechanism in Google Cloud provides a distinct balance of operational management and key control. Google-default encryption is fully automated. CMEK grants control over key rotation and IAM policies inside Cloud KMS. CSEK allows customers to supply raw keys per API call. Cloud EKM delegates key protection to external on-premises or third-party HSMs.

Step-by-Step Solution

1
Identify the key storage location and management responsibility for Google-default encryption.
Recognize that Google handles all encryption key lifecycle operations automatically without user intervention.
Google-default encryption is fully managed by GCP for data at rest.
2
Analyze Customer-Managed Encryption Keys (CMEK).
Associate CMEK with Cloud KMS where key policies, rotation, and IAM access are customer-configured.
CMEK provides customer control over key lifecycles hosted within Google Cloud infrastructure.
3
Analyze Customer-Supplied Encryption Keys (CSEK).
Link CSEK to raw AES-256 keys supplied per request header that exist only temporarily in volatile memory.
CSEK guarantees Google does not retain key material after the request finishes.
4
Analyze Cloud External Key Manager (Cloud EKM).
Connect EKM to keys residing in external HSM systems outside Google Cloud.
Cloud EKM enables cryptographic operations using keys hosted in an off-cloud HSM.

Key Concept

Data Encryption Options and Key Management Models in GCP
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic