Examkin

Question

Difficulty: MediumData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise organization is migrating a transactional analytics workload to Google Cloud. The compliance team mandates that sensitive data stored in Cloud Storage and BigQuery must be encrypted at rest using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS. Additionally, security policy dictates strict separation of duties between key management operations and data processing tasks. Which TWO architectural configuration steps should the cloud security architect perform to satisfy these requirements? (Select TWO.)

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the designated KMS key to the Google-managed Service Agents for Cloud Storage and BigQuery.Answer
  2. Assign the Cloud KMS Admin role to the security administration team while withholding cryptographic encrypter and decrypter roles from them.Answer
  3. C
    Grant the primitive Owner IAM role on the project to the Cloud Storage and BigQuery service accounts to allow automated key creation and rotation.
  4. D
    Upload raw 256-bit AES Customer-Supplied Encryption Keys (CSEK) into Cloud KMS key rings to allow Google Cloud to automate external key rotation.

Answer

The architect must grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed Service Agents for Cloud Storage and BigQuery, and assign the Cloud KMS Admin role to the security administration team without granting encryption or decryption permissions.
Configuring CMEK for GCP services requires granting the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Google-managed service agents for Cloud Storage and BigQuery. Simultaneously, separation of duties is achieved by granting the Cloud KMS Admin role to security personnel while intentionally withholding data decryption roles.

Step-by-Step Solution

1
Identify the service accounts performing cryptographic operations.
Determine that Google-managed Service Agents (e.g., service-[PROJECT_NUMBER]@gs-project-accounts.iam.gserviceaccount.com) perform CMEK encryption and decryption on behalf of Cloud Storage and BigQuery.
Google Cloud services require dedicated service agent identity permissions to interact with Cloud KMS keys.
2
Apply least-privilege KMS IAM roles for workload service agents.
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the target CryptoKey to the service agents.
This allows the automated storage services to encrypt and decrypt dataset objects using the specified CMEK key without over-granting administrative rights.
3
Enforce separation of duties for security key administrators.
Assign `roles/cloudkms.admin` to the security team while omitting encrypter/decrypter permissions.
Separating administrative key management from data decryption capabilities ensures key managers cannot read sensitive customer datasets.

Key Concept

CMEK Service Agent Authorization and Separation of Duties in Cloud KMS
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic