Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A software security firm is deploying a sensitive workload on Google Compute Engine that requires customer-managed encryption keys (CMEK) hosted in Cloud KMS for persistent disk encryption. Corporate policy mandates a strict separation of duties: compute infrastructure administrators must manage virtual machine lifecycles, but they must NOT have access to read, decrypt, or manage cryptographic key materials directly. You need to configure IAM access control to meet these requirements. Which TWO actions should you perform? (Select TWO.)

  1. Grant the Compute Engine Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the target Cloud KMS key.Answer
  2. Grant compute infrastructure administrators the Compute Admin role while withholding Cloud KMS Admin and Cloud KMS CryptoKey Encrypter/Decrypter roles.Answer
  3. C
    Grant compute infrastructure administrators the primitive Owner role at the project level to automate resource and cryptographic key binding management.
  4. D
    Supply a raw 256-bit Customer-Supplied Encryption Key (CSEK) inside the Compute Engine instance metadata to allow administrators to manage key rotation directly.

Answer

Grant the Compute Engine Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the target key, and assign compute infrastructure administrators the Compute Admin role without Cloud KMS key management permissions.
To implement CMEK on Compute Engine persistent disks while enforcing separation of duties, the Compute Engine Service Agent must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role so that Google Cloud infrastructure can encrypt and decrypt disk blocks. Simultaneously, human compute administrators should receive only compute-related predefined roles (such as Compute Admin) without Cloud KMS roles, ensuring they can manage virtual machines without gaining access to encryption keys.

Step-by-Step Solution

1
Identify the service principal responsible for encryption operations
Recognize that Compute Engine uses its service agent (e.g., [email protected]) to access Cloud KMS keys for persistent disks.
Google Cloud service agents perform cryptographic disk operations under CMEK architectures.
2
Configure key access permissions for the service agent
Grant the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Compute Engine Service Agent on the specified key.
This allows Google Cloud to handle encryption/decryption transparently on disk attachment without granting human administrators access to key material.
3
Enforce separation of duties for human administrators
Grant human administrators the Compute Admin role while omitting Cloud KMS permissions.
This ensures compute administrators can create and maintain virtual machines while satisfying compliance rules against direct cryptographic key access.

Key Concept

Separation of duties using Cloud KMS Customer-Managed Encryption Keys (CMEK) and IAM service agent roles
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic