Examkin

Question

Difficulty: EasyData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A healthcare provider must store patient records in Cloud Storage. Regulatory requirements mandate that the encryption keys protecting the data must reside exclusively within the company's on-premises Hardware Security Module (HSM) and never be stored inside Google Cloud, while allowing Google Cloud Storage to perform automated encryption and decryption operations. Which key management solution should you select?

  1. Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM)Answer
  2. B
    Customer-Supplied Encryption Keys (CSEK) managed via primitive Owner IAM roles
  3. C
    Google-default encryption guarded by VPC Service Controls
  4. D
    Customer-Supplied Encryption Keys (CSEK) with automated key rotation configured in Cloud KMS

Answer

Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM)
Cloud External Key Manager (Cloud EKM) enables GCP services to use Customer-Managed Encryption Keys (CMEK) where the actual key material resides outside Google Cloud in an on-premises or external Key Management Service / HSM.

Step-by-Step Solution

1
Identify key storage constraints
Keys must reside in an on-premises HSM external to Google Cloud.
Regulatory compliance requires physical key control off-cloud.
2
Evaluate key management mechanisms in GCP
Cloud External Key Manager (Cloud EKM) allows Cloud KMS to use keys hosted in third-party or on-premises key managers.
Cloud EKM bridges CMEK integration with external key storage.

Key Concept

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic