Examkin

Soru

Zorluk: KolayData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An organization is deploying an application on Google Cloud and needs to configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS to protect sensitive data stored in Cloud Storage buckets and Compute Engine persistent disks. Which TWO requirements must be met to properly implement CMEK for these services? (Select TWO)

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the KMS key to the Google-managed service account for each respective GCP service.Cevap
  2. B
    Upload raw 256-bit AES symmetric keys directly through the gcloud CLI during resource creation to allow Cloud KMS to manage key decryption.
  3. Specify the Cloud KMS key resource ID when creating the Cloud Storage bucket or Compute Engine persistent disk.Cevap
  4. D
    Assign the primitive Owner role on the Cloud KMS project to the Compute Engine default service account to ensure cryptographic access.

Cevap

The correct requirements are granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed service accounts for Cloud Storage and Compute Engine, and referencing the Cloud KMS key resource ID during resource creation.
Implementing CMEK for GCP resources requires providing the Cloud KMS key resource ID to the target service (such as Cloud Storage or Compute Engine) and granting the specific service agent the Cloud KMS CryptoKey Encrypter/Decrypter role so it can perform encryption/decryption operations.

Adım Adım Çözüm

1
Identify the key management model being requested.
The scenario specifically asks for Customer-Managed Encryption Keys (CMEK) using Cloud KMS.
CMEK relies on keys hosted inside Google Cloud KMS rather than key material generated and supplied out-of-band by the customer in API requests.
2
Determine IAM permission requirements for GCP service integration.
GCP services use dedicated service agents to interact with Cloud KMS keys.
The service agents require the minimal predefined role 'roles/cloudkms.cryptoKeyEncrypterDecrypter' on the targeted CryptoKey.
3
Determine resource binding requirements.
Resources must be explicitly configured with the Cloud KMS key URI upon creation.
Providing the key resource ID instructs Google Cloud to encrypt new objects or persistent disks using the specified CMEK key.

Anahtar Kavram

Customer-Managed Encryption Keys (CMEK) and Service Agent IAM Configuration
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru