Examkin

Soru

Zorluk: OrtaData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise organization is migrating sensitive customer identity verification files to Cloud Storage. Compliance policy dictates that the key encryption keys (KEKs) must physically reside within the organization's existing on-premises Hardware Security Module (HSM) and that Google Cloud must never store the root key material. Additionally, application developers must not handle raw key material directly in application code or send key bytes within individual HTTP request headers. Which encryption strategy should you recommend?

  1. Configure Cloud KMS with Cloud External Key Manager (Cloud EKM) to reference the on-premises HSM key, and set the Cloud Storage bucket to use Customer-Managed Encryption Keys (CMEK).Cevap
  2. B
    Use Customer-Supplied Encryption Keys (CSEK) by configuring bucket-level default metadata to automatically pull key material from the on-premises HSM.
  3. C
    Assign the primitive Owner IAM role (roles/owner) to the Cloud Storage Service Agent so it can directly authenticate and retrieve keys from the on-premises key management service.
  4. D
    Use Google-default encryption keys for Cloud Storage objects while configuring a VPC Service Controls perimeter to protect the key material from external access.

Cevap

Configure Cloud KMS with Cloud External Key Manager (Cloud EKM) connected to the on-premises HSM, and use Customer-Managed Encryption Keys (CMEK) on the Cloud Storage bucket.
The correct choice utilizes Cloud External Key Manager (Cloud EKM) paired with Cloud KMS. Cloud EKM enables Google Cloud services like Cloud Storage to encrypt data at rest via Customer-Managed Encryption Keys (CMEK) while keeping the master keys inside an external on-premises HSM, fulfilling both physical key custody and seamless developer experience requirements.

Adım Adım Çözüm

1
Analyze key location and key custody constraints.
The requirement states that root keys must reside in an on-premises HSM and Google Cloud must never store the root key material.
This rules out Google-managed keys and standard Cloud KMS/Cloud HSM keys hosted entirely inside Google Cloud.
2
Evaluate application key handling constraints.
Developers must not supply key material in HTTP headers or handle raw key bytes.
This rules out Customer-Supplied Encryption Keys (CSEK), which require explicit key headers on every request.
3
Identify the service that bridges Cloud KMS/CMEK with external HSMs.
Cloud External Key Manager (Cloud EKM) allows Cloud KMS to delegate cryptographic operations to an external key manager/HSM over a secure connection.
By attaching Cloud EKM keys as CMEK on the Cloud Storage bucket, seamless bucket-level encryption is achieved without exposing key bytes to applications.

Anahtar Kavram

Cloud EKM with CMEK for external key governance
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru