Examkin

Soru

Zorluk: Çok zorData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A healthcare enterprise is migrating a relational database workload to Cloud SQL for PostgreSQL. Regulatory compliance mandates that the enterprise maintain physical and cryptographic sovereignty over the root encryption key within their on-premises Hardware Security Module (HSM), strictly prohibiting raw root key material from ever being generated or stored within Google Cloud infrastructure. Simultaneously, the security team requires seamless data-at-rest protection for Cloud SQL without modifying application code for client-side encryption. Which encryption and key management architecture satisfies all compliance and operational requirements?

  1. Configure Cloud SQL to use Customer-Managed Encryption Keys (CMEK) backed by Cloud External Key Manager (Cloud EKM), routing key requests to the on-premises HSM over a dedicated private network connection.Cevap
  2. B
    Configure Cloud SQL with Customer-Supplied Encryption Keys (CSEK) by providing the raw AES-256 encryption key directly in instance configuration parameters during creation and restart.
  3. C
    Provision a Cloud KMS key ring with Cloud HSM protection, grant the Cloud SQL service account the primitive Owner role on the key project, and schedule automated key sync jobs from the on-premises HSM.
  4. D
    Establish a VPC Service Controls perimeter around Cloud SQL and Cloud KMS, configuring database client applications to perform asymmetric key encryption using Cloud KMS APIs prior to inserting data.

Cevap

Configure Cloud SQL to use Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM) connected to the on-premises HSM over a private network.
The solution leveraging Cloud External Key Manager (Cloud EKM) backed by Cloud KMS enables Cloud SQL to encrypt data at rest using CMEK while keeping the master encryption keys stored exclusively within the customer's on-premises HSM. Key requests are securely routed over private connectivity whenever cryptographic operations are required.

Adım Adım Çözüm

1
Analyze regulatory constraints regarding key sovereignty and storage locations.
Identified that key material must reside strictly inside the customer's on-premises HSM and cannot be generated or stored directly in Google Cloud (ruling out Google-default encryption, standard Cloud KMS, and Cloud HSM).
Regulatory compliance forbids raw key material inside GCP.
2
Evaluate service compatibility and operational integration requirements for Cloud SQL.
Cloud SQL supports Customer-Managed Encryption Keys (CMEK) for transparent storage encryption without requiring application code changes.
Database encryption must be transparent to application logic.
3
Select the appropriate GCP key management capability that bridges external HSMs with GCP service CMEK.
Cloud External Key Manager (Cloud EKM) allows Cloud KMS to delegate cryptographic operations to an external HSM over a secure connection (Cloud Interconnect/VPN), satisfying both external sovereignty and transparent CMEK integration.
Cloud EKM fulfills the requirement for external key sovereignty while supporting native CMEK integrations.

Anahtar Kavram

Cloud External Key Manager (Cloud EKM) and Customer-Managed Encryption Keys (CMEK)
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru