Examkin

Soru

Zorluk: KolayData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A financial organization needs to store sensitive audit logs in Google Cloud Storage. Regulatory requirements mandate that the organization retain control of the cryptographic keys using Google Cloud Key Management Service (Cloud KMS) to support automated key rotation. They do not want the operational burden of managing and supplying raw key material for every storage request. Which encryption approach should the cloud architect recommend?

  1. Customer-Managed Encryption Keys (CMEK) using Cloud KMSCevap
  2. B
    Customer-Supplied Encryption Keys (CSEK) provided with each API request
  3. C
    Granting primitive Owner IAM roles on the bucket to restrict access to default Google-managed keys
  4. D
    Standard IAM policies without key management, assuming access controls prevent unauthorized data exfiltration

Cevap

Customer-Managed Encryption Keys (CMEK) using Cloud KMS
Customer-Managed Encryption Keys (CMEK) allow customers to control key lifecycle management and automated key rotation through Google Cloud KMS, satisfying regulatory control requirements without requiring raw key management per request.

Adım Adım Çözüm

1
Identify key management requirements
The requirement requests using Cloud KMS with key control and automated rotation without managing raw key material directly per request.
Regulatory compliance specifies key ownership within GCP's KMS solution.
2
Evaluate Google Cloud encryption options
CMEK uses Cloud KMS to manage keys and supports automatic rotation, meeting all client specifications.
CSEK requires managing raw keys outside GCP, whereas default encryption does not give key control to the customer.

Anahtar Kavram

Customer-Managed Encryption Keys (CMEK) vs Customer-Supplied Encryption Keys (CSEK) in GCP
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru