Examkin

Soru

Zorluk: ZorData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise financial application processes sensitive event streams using Cloud Pub/Sub before storing data in long-term storage. Corporate compliance policies dictate that all data at rest within Cloud Pub/Sub topics must be encrypted using cryptographic keys residing in an external, on-premises Hardware Security Module (HSM), ensuring raw key material is never held or stored within Google Cloud infrastructure. Additionally, access to encryption and decryption operations must strictly adhere to the principle of least privilege. Which architecture and key management configuration meets these requirements?

  1. Configure Cloud EKM (External Key Manager) within Cloud KMS to connect to the on-premises HSM, and grant the Pub/Sub Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the Cloud KMS key.Cevap
  2. B
    Generate raw 256-bit AES Customer-Supplied Encryption Keys (CSEK) on the on-premises HSM, and pass the key material directly within the headers of each Pub/Sub API publish call.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS Cloud HSM, and grant the primitive Editor role to the default Compute Engine service account to handle key lifecycle operations.
  4. D
    Define a VPC Service Controls perimeter around Cloud Pub/Sub and rely on default Google-managed encryption keys to automatically protect topic data at rest from external access.

Cevap

Configure Cloud EKM (External Key Manager) within Cloud KMS to reference keys hosted on the on-premises HSM, and grant the Pub/Sub Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.
The correct solution uses Cloud EKM (External Key Manager) to keep key material in an external on-premises HSM while enabling Cloud KMS to orchestrate Pub/Sub message encryption. Assigning the specific Cloud KMS CryptoKey Encrypter/Decrypter role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) to the Pub/Sub Service Agent complies strictly with the principle of least privilege.

Adım Adım Çözüm

1
Identify the key location requirement
Because the keys must reside inside an external, on-premises HSM while performing encryption for GCP services, Cloud EKM (External Key Manager) integrated with Cloud KMS must be selected.
Google Cloud default encryption and standard CMEK/Cloud HSM host key material within Google Cloud infrastructure, whereas Cloud EKM allows key material to remain strictly on-premises.
2
Determine service integration and identity permissions
Cloud Pub/Sub uses a Google-managed service agent to perform encryption and decryption operations on behalf of the application.
To support CMEK/Cloud EKM with Pub/Sub, the Pub/Sub Service Agent (`serviceAccount:[email protected]`) must be granted permissions.
3
Apply least privilege access controls
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Pub/Sub Service Agent specifically on the relevant Cloud KMS key resource.
Using fine-grained, predefined KMS roles prevents granting overbroad administrative or project-wide primitive permissions.

Anahtar Kavram

Cloud EKM (External Key Manager) enables GCP services like Pub/Sub to encrypt data using keys stored in an external third-party key management system or on-premises HSM, while granting service agents fine-grained KMS encrypter/decrypter roles enforces least privilege.
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru