Examkin

Soru

Zorluk: ZorData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A enterprise healthcare provider is deploying an application on Google Cloud that processes confidential patient health information stored on Compute Engine persistent disks. Corporate governance requires that the enterprise retain central governance over key lifecycle management—including automated key rotation—while strictly isolating key administrative duties from workload management. Furthermore, application compute infrastructure must be restricted to performing encryption and decryption operations using the principle of least privilege. How should the cloud architect design the key management and IAM architecture to meet these requirements?

  1. Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS in a centralized security project, set up an automated key rotation schedule, and grant the predefined Cloud KMS CryptoKey Encrypter/Decrypter role on the key to the Compute Engine Service Agent of the workload project.Cevap
  2. B
    Generate raw 256-bit AES Customer-Supplied Encryption Keys (CSEK), store them in an on-premises vault, and pass the raw key strings directly in compute disk API creation calls to maintain lifecycle control and enable automated key rotation.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS in the workload project, and grant the primitive Editor role on the KeyRing to the workload application service account to permit key access and management.
  4. D
    Use Google-default encryption for all persistent disks and establish a VPC Service Controls perimeter surrounding the compute instances to satisfy key governance and automated rotation requirements.

Cevap

The correct architecture uses Customer-Managed Encryption Keys (CMEK) provisioned within Cloud KMS in a dedicated security project. Automated rotation is configured within Cloud KMS, and the specific Cloud KMS CryptoKey Encrypter/Decrypter role is granted to the Compute Engine Service Agent in the workload project.
Using CMEK via Cloud KMS housed in a separate security project satisfies key lifecycle ownership, automated rotation, and strict separation of duties. Granting the predefined `roles/cloudkms.cryptoKeyEncrypterDecrypter` role to the Compute Engine Service Agent follows the principle of least privilege by allowing the compute infrastructure to encrypt/decrypt data without granting key management rights.

Adım Adım Çözüm

1
Identify key governance and rotation requirements
Customer-Managed Encryption Keys (CMEK) in Cloud KMS are required because CMEK provides automated key rotation, administrative isolation, and native integration with GCP services.
CSEK does not support automated rotation in GCP, and Google-default encryption does not offer customer control over key lifecycles.
2
Enforce project isolation for separation of duties
Provision Cloud KMS KeyRings and CryptoKeys in a separate, secure Google Cloud project dedicated to security administration.
Isolating security administration from the application workload project prevents workload admins from altering key policies or key states.
3
Assign least privilege IAM roles for disk encryption
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key resource to the workload project's Compute Engine Service Agent (`[email protected]`).
Compute Engine persistent disk encryption operations are executed by the service agent using envelope encryption under least privilege.

Anahtar Kavram

Customer-Managed Encryption Keys (CMEK) with Cloud KMS and IAM Least Privilege
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru