Examkin

Question

Difficulty: EasyData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise cloud security team needs to encrypt data stored in a Cloud Storage bucket. Security compliance mandates that the enterprise must retain complete control over key lifecycle management, including key rotation and revocation using Google Cloud APIs, without the overhead of manually managing and supplying raw cryptographic keys for every data access request. Which encryption approach should the cloud architect recommend?

  1. Use Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.Answer
  2. B
    Use Customer-Supplied Encryption Keys (CSEK) passed with every storage API request.
  3. C
    Use Google-default encryption with service-managed keys.
  4. D
    Use Cloud KMS and grant all storage users the primitive Owner IAM role on the key ring.

Answer

Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.
Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow organizations to maintain control over key creation, rotation, and revocation, while allowing Google Cloud services to automatically encrypt and decrypt data at rest.

Step-by-Step Solution

1
Identify key lifecycle control requirement
The requirement demands customer management of key generation, rotation, and revocation policies.
Google-default keys do not provide direct customer lifecycle management.
2
Evaluate operational burden constraints
The requirement specifies avoiding manual key transmission/supplying per API call.
Customer-Supplied Encryption Keys (CSEK) force the caller to manage raw keys and provide them with every operation, whereas Customer-Managed Encryption Keys (CMEK) integrate natively with Cloud KMS and GCP storage services.
3
Select the appropriate encryption key model
Cloud KMS CMEK satisfies customer control over key lifecycles without requiring raw key handling.
CMEK uses Cloud KMS to manage keys while GCP services handle data encryption seamlessly.

Key Concept

Customer-Managed Encryption Keys (CMEK) vs Customer-Supplied Encryption Keys (CSEK)
Estimated Time:45s
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic