Examkin

Question

Difficulty: HardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Match each enterprise security and governance requirement to its corresponding Google Cloud data encryption and key management model.

  • Automated key rotation policies with cryptographic key material stored inside FIPS 140-2 Level 3 validated hardware security modules managed within Google Cloud.Customer-Managed Encryption Keys (CMEK) via Cloud HSM
  • Supplying raw 256-bit AES keys directly in API request headers for transient in-memory use, ensuring Google Cloud never persists the root key material.Customer-Supplied Encryption Keys (CSEK)
  • Retaining absolute ownership of root cryptographic keys within an external on-premises HSM while authorizing GCP services to invoke external key management endpoints.Cloud External Key Manager (Cloud EKM)
  • Automatic data protection at rest using symmetric keys without requiring custom IAM configurations, key lifecycle management, or operational oversight.Google-default Encryption

Answer

Matching pairings: FIPS 140-2 Level 3 automated key rotation maps to CMEK via Cloud HSM; Per-request raw key injection without persistence maps to CSEK; External key management via on-premises HSM endpoints maps to Cloud EKM; Zero-configuration automated encryption maps to Google-default Encryption.
Each encryption model aligns with specific key control boundaries: Google-default is zero-configuration baseline encryption; CMEK via Cloud HSM offers managed hardware protection (FIPS 140-2 Level 3) with Cloud KMS automated rotation; CSEK requires raw AES-256 keys passed per request without storage; Cloud EKM delegates key operations to external on-premises HSM endpoints.

Step-by-Step Solution

1
Analyze the requirement for automated rotation within a cloud-managed hardware security module.
CMEK backed by Cloud HSM fulfills FIPS 140-2 Level 3 requirements while allowing automated rotation via Cloud KMS.
Cloud HSM hosts key material natively within Google's cloud security boundary under hardware protection.
2
Evaluate the requirement for per-request raw key injection without persistence by Google.
CSEK requires raw 256-bit AES key material passed in API headers for transient in-memory operations.
CSEK ensures Google Cloud stores neither the root key nor key wrapping structures across API calls.
3
Identify the external key sovereignty pattern connecting GCP services to on-premises HSM APIs.
Cloud EKM establishes API connectivity between Google Cloud services and third-party external key managers.
Cloud EKM guarantees root keys reside physically outside Google Cloud infrastructure at all times.
4
Identify the baseline zero-overhead encryption model.
Google-default encryption transparently handles symmetric key generation and data encryption out of the box.
All Google Cloud storage and database services automatically encrypt data at rest by default.

Key Concept

Classification of GCP Data Encryption Models (Google-default, CMEK/Cloud HSM, CSEK, Cloud EKM)
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic