Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A global logistics firm is storing confidential shipment documentation in Google Cloud Storage. The firm's compliance team mandates that encryption keys must be managed in Cloud KMS by an isolated security team, support automated key rotation every 90 days, and enforce separation of duties so developers cannot directly access raw key material or administrative key controls. Which architectural configuration should you recommend to fulfill these requirements?

  1. Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, grant key administration roles exclusively to the security team, and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.Answer
  2. B
    Implement Customer-Supplied Encryption Keys (CSEK) passed with each object upload request, and configure Cloud KMS to automatically manage key rotation schedules.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, and grant the Cloud Storage Service Agent the primitive Owner role on the project containing the Cloud KMS KeyRing.
  4. D
    Rely on Google-default encryption at rest for Cloud Storage, and restrict access using standard Cloud Storage IAM bucket roles to prevent unauthorized data exfiltration.

Answer

Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, grant key administration roles exclusively to the security team, and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.
Customer-Managed Encryption Keys (CMEK) allow enterprise security teams to retain full control over key lifecycle, rotation, and IAM permissions in Cloud KMS. Granting the specific `roles/cloudkms.cryptoKeyEncrypterDecrypter` role to the Cloud Storage Service Agent adheres to least privilege and maintains separation of duties.

Step-by-Step Solution

1
Identify key management requirements
Requirements specify key management in Cloud KMS with automated rotation and separation of duties, ruling out Google-default encryption and CSEK.
CSEK requires managing key material outside of Google Cloud and passing raw keys per API call, which prevents Cloud KMS automated rotation.
2
Determine IAM permissions required for service integration
The Cloud Storage Service Agent needs permission to encrypt and decrypt data using the specified Cloud KMS key.
Using predefined fine-grained roles (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) enforces least privilege, whereas primitive roles (`roles/owner`) grant excessive administrative privileges.
3
Synthesize the optimal architecture
CMEK with Cloud KMS key rotation paired with least-privilege IAM grants for the Cloud Storage Service Agent meets all compliance standards.
This setup establishes strict separation of duties between key management admins and service usage.

Key Concept

Customer-Managed Encryption Keys (CMEK) and KMS IAM Least Privilege
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic