Examkin

Soru

Zorluk: ZorManaging Encryption Keys with Cloud KMS

A cloud security engineer receives an alert that a specific key version of a CryptoKey in Cloud KMS may have been exposed. The security policy dictates that no new data should be encrypted using this compromised key version, but existing backup files encrypted with prior key versions must remain decryptable by authorized service accounts. Additionally, to clean up the project resources, the engineer attempts to remove the parent KeyRing that holds the CryptoKey. Which action correctly fulfills the security requirement while reflecting Cloud KMS resource capabilities?

  1. Disable the compromised CryptoKey version, and acknowledge that Cloud KMS KeyRings and CryptoKeys cannot be deleted once created.Cevap
  2. B
    Execute a deletion command on the parent KeyRing resource to permanently remove all associated CryptoKeys and key versions from the GCP project.
  3. C
    Assign the Project Owner primitive role to the service account so it can execute an immediate force-delete on the CryptoKey object.
  4. D
    Revoke the Cloud KMS CryptoKey Encrypter/Decrypter role at the KeyRing level, assuming it overrides the inherited access granted at the Project level.

Cevap

Disable the compromised CryptoKey version, and acknowledge that Cloud KMS KeyRings and CryptoKeys cannot be deleted once created.
Disabling a specific CryptoKey version stops it from being used for cryptographic operations. Furthermore, Cloud KMS enforces strict immutability for catalog structure: KeyRings and CryptoKeys cannot be deleted once created.

Adım Adım Çözüm

1
Analyze key lifecycle options in Cloud KMS
Disabling a specific CryptoKeyVersion prevents any future cryptographic operations (encryption/decryption) using that specific version, which addresses the security compromise requirement.
Cloud KMS allows managing individual key versions independently through state transitions (Enabled, Disabled, Scheduled for destruction, Destroyed).
2
Evaluate resource deletion capabilities in Cloud KMS
Recognize that KeyRings and CryptoKeys are immutable resources in terms of deletion; they cannot be deleted from a GCP project.
Google Cloud KMS intentionally prevents the deletion of KeyRings and CryptoKeys to preserve audit logs, prevent key loss disasters, and ensure cryptographic history remain traceable.
3
Evaluate IAM policy inheritance
Confirm that IAM roles granted at parent levels (e.g., Project) are inherited downwards and cannot be restricted by child-level revocations.
IAM permissions are purely additive; child resources inherit all access granted at higher levels in the GCP resource hierarchy.

Anahtar Kavram

Cloud KMS Key Lifecycle and Resource Immutability
Bu soruyu puanla

Konular

Managing Encryption Keys with Cloud KMS

Bu konudan daha fazla soru