Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise healthcare organization stores sensitive patient diagnostic datasets in Google Cloud Storage. Corporate regulatory compliance mandates that all data at rest must be encrypted using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS, key rotation must be automated annually without requiring re-encryption of existing data, and key access permissions must strictly adhere to the principle of least privilege. Which configuration strategy satisfies these security and compliance requirements?

  1. A
    Supply a raw 256-bit AES Customer-Supplied Encryption Key (CSEK) header with every upload request and run a scheduled on-premises script to regenerate and supply new raw key material annually.
  2. Configure the Cloud Storage bucket with a Cloud KMS CMEK key, grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the key, and set an automated 365-day rotation schedule on the CryptoKey.Answer
  3. C
    Configure the Cloud Storage bucket with a Cloud KMS key and grant the Editor primitive IAM role to the project service account so that it can manage both Cloud KMS resources and storage bucket objects.
  4. D
    Enclose the Cloud Storage bucket inside a VPC Service Controls perimeter and rely on perimeter ingress/egress rules to enforce data encryption without assigning key IAM roles to service identities.

Answer

Configure the Cloud Storage bucket using a Customer-Managed Encryption Key (CMEK) stored in Cloud KMS, assign the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud Storage Service Agent, and define an automated 365-day rotation schedule on the key.
To satisfy customer-managed encryption (CMEK) requirements in Google Cloud Storage with least privilege, key management must be delegated to Cloud KMS. The Google-managed Cloud Storage Service Agent requires the dedicated `roles/cloudkms.cryptoKeyEncrypterDecrypter` role on the CryptoKey to perform cryptographic operations. Configuring an automatic 365-day rotation period directly on the Cloud KMS key ensures compliance without manual intervention or data re-encryption.

Step-by-Step Solution

1
Identify key management architecture requirements
Cloud KMS CMEK is required (eliminating raw key management models like CSEK).
Compliance specifies managing keys in Cloud KMS rather than supplying raw keys on every HTTP request.
2
Apply least privilege IAM roles for CMEK
The Cloud Storage Service Agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) requires roles/cloudkms.cryptoKeyEncrypterDecrypter.
Cloud Storage performs encryption and decryption operations asynchronously using its managed service agent identity, not primitive user/editor roles.
3
Configure key rotation schedule
Set a 365-day rotation period on the Cloud KMS CryptoKey.
Automated key rotation generates new key versions periodically without modifying existing encrypted data or requiring manual key re-upload.

Key Concept

Cloud Storage CMEK Integration and Cloud KMS Service Agent IAM Least Privilege
Estimated Time:1m 30s
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic