Examkin

Soru

Zorluk: ZorManaging Encryption Keys with Cloud KMS

An enterprise organization is establishing a security baseline for cryptographic operations using Google Cloud KMS across multiple GCP projects. The security team needs to enforce strict separation of duties, adhere to the principle of least privilege, and follow proper key management lifecycle practices. Which TWO of the following configurations or operational steps should the security team implement?

  1. Disable or schedule destruction of specific CryptoKey versions during key lifecycle maintenance rather than attempting to delete the parent Key Ring resource.Cevap
  2. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the relevant service's Google Cloud Service Agent instead of granting broad permissions to service accounts or users.Cevap
  3. C
    Permanently delete the Cloud KMS Key Ring resource immediately after rotating key versions to prevent unauthorized access to legacy cryptographic metadata.
  4. D
    Assign the primitive Owner role on the key host project to application service accounts so they can dynamically manage key rings and encrypt data.
  5. E
    Revoke permissions at the target project level to override a Cloud KMS CryptoKey Encrypter/Decrypter role granted higher up at the Organization node.

Cevap

The security team should disable or schedule destruction of specific CryptoKey versions (instead of trying to delete key rings) and grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the service agent for the target GCP service.
The correct configurations involve disabling or scheduling destruction of CryptoKey versions (since Key Rings and CryptoKey resources cannot be deleted in Google Cloud KMS) and granting the predefined Cloud KMS CryptoKey Encrypter/Decrypter role to the Google Cloud Service Agent managing the encrypted resource, upholding least privilege and separation of duties.

Adım Adım Çözüm

1
Analyze Cloud KMS resource deletion limitations
Identify that Key Rings and CryptoKey resources are permanent in GCP project records and cannot be deleted, but individual CryptoKey versions can be disabled or destroyed.
Cloud KMS retains key ring and key names permanently for tracking and compliance integrity.
2
Evaluate IAM access control for CMEK usage
Determine that service agents require the predefined Cloud KMS CryptoKey Encrypter/Decrypter role to perform cryptographic operations on behalf of GCP resources.
Granting least-privilege predefined roles to service agents ensures separation of duties between key administrators and service consumers.
3
Identify misconceptions in distractors
Reject options proposing key ring deletion, primitive role assignments, or lower-level IAM revocations.
GCP IAM policies inherit additively without explicit denial overrides, primitive roles grant overbroad access, and Cloud KMS key rings cannot be deleted.

Anahtar Kavram

Cloud KMS Separation of Duties and Key Lifecycle Management
Bu soruyu puanla

Konular

Managing Encryption Keys with Cloud KMS

Bu konudan daha fazla soru