Examkin

Soru

Zorluk: KolayManaging Encryption Keys with Cloud KMS

A security engineer is configuring access controls and key management policies for cryptographic keys in Google Cloud KMS. Which TWO of the following statements correctly describe operational practices or resource constraints in Cloud KMS? (Select TWO answers.)

  1. Cloud KMS key rings and cryptographic key resources cannot be deleted once created; retiring key material requires disabling or scheduling destruction of key versions.Cevap
  2. Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to service accounts enables data encryption and decryption while enforcing separation of duties without granting key management rights.Cevap
  3. C
    Deleting the parent key ring in the Cloud Console immediately purges all child key versions and stops billing for the associated key material.
  4. D
    Assigning the project-level Owner primitive role to security administrators is mandatory for enabling automated key rotation across projects.
  5. E
    Attaching a restrictive IAM binding at the key ring level overrides and revokes administrative key permissions inherited from project-level IAM roles.

Cevap

The correct statements are that key rings and cryptographic keys cannot be deleted (retiring key material requires disabling or destroying key versions) and that assigning the Cloud KMS CryptoKey Encrypter/Decrypter role to service accounts enforces separation of duties without granting key management rights.
In Google Cloud KMS, key rings and cryptographic key resources cannot be deleted once created; key retirement is managed strictly by disabling or destroying individual key versions. Furthermore, using predefined roles such as Cloud KMS CryptoKey Encrypter/Decrypter upholds separation of duties by allowing workloads to perform cryptographic operations without granting administrative key management permissions.

Adım Adım Çözüm

1
Evaluate key resource lifecycle rules in Google Cloud KMS.
Recognize that key rings and key resources are permanent and cannot be deleted. Disabling or destroying key versions is the required method for key retirement.
Cloud KMS guarantees resource name immutability to preserve cryptographic audit trails.
2
Assess IAM roles for Cloud KMS operational tasks.
Confirm that predefined roles like Cloud KMS CryptoKey Encrypter/Decrypter grant specific cryptographic capabilities to service accounts without exposing key administrative permissions.
Applying principle of least privilege requires separation of duties between key users and key administrators.
3
Identify misconceptions in wrong choices.
Reject key ring deletion claims, primitive Owner role requirements, and lower-level IAM permission restriction assumptions.
Key rings cannot be deleted, primitive roles violate least privilege, and IAM permissions are strictly additive down the hierarchy.

Anahtar Kavram

Cloud KMS Key Lifecycle and IAM Separation of Duties
Bu soruyu puanla

Konular

Managing Encryption Keys with Cloud KMS

Bu konudan daha fazla soru