Examkin

Soru

Zorluk: Çok zorProvisioning Storage and Database Systems

An enterprise healthcare platform is provisioning a mission-critical Cloud SQL PostgreSQL database instance to store sensitive patient telemetry data. Corporate security policy mandates that data at rest must be encrypted using encryption keys that support automated 90-day key rotation, provide complete centralized key access auditing in Cloud Audit Logs, and require zero raw cryptographic key material handling by the application layer. Which configuration should the cloud architect specify during initial database provisioning to satisfy all requirements?

  1. Provision the database instance using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and grant the Cloud SQL service account the CryptoKey Encrypter/Decrypter role on the specified key.Cevap
  2. B
    Provision the database instance using Customer-Supplied Encryption Keys (CSEK) by including an inline 256-bit AES key in the provision API request and passing the key in application headers for runtime operations.
  3. C
    Provision the database instance using default Google-managed encryption keys, and assign the primitive Editor role to the database service account to enable centralized key access auditing.
  4. D
    Provision the database instance with Cloud KMS encryption while configuring the local Terraform state file to store unencrypted key material for automated rotation scripts.

Cevap

Provision the database instance using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and grant the Cloud SQL service account the CryptoKey Encrypter/Decrypter role on the specified key.
Provisioning the database with Customer-Managed Encryption Keys (CMEK) via Cloud KMS allows organization administrators to establish automated 90-day key rotation schedules, track key access in Cloud Audit Logs, and grant permissions via IAM roles without exposing raw key material to the application tier. Granting the Cloud SQL service account the CryptoKey Encrypter/Decrypter role ensures the database engine can encrypt and decrypt data at rest seamlessly.

Adım Adım Çözüm

1
Analyze compliance requirements for database encryption
Identify need for automated 90-day rotation, centralized Cloud Audit Log integration, and zero application handling of raw key material.
Choosing the correct GCP encryption model depends on where key management responsibility and key material handling reside.
2
Compare Google Cloud encryption options (Default, CMEK, CSEK)
CMEK allows Cloud KMS key management with automated rotation schedules and IAM-controlled service account access without application key exposure.
CSEK requires application-managed raw keys for every API operation, whereas CMEK delegates cryptographic operations to Cloud KMS.
3
Determine necessary IAM role bindings for database provisioning
Grant the Cloud SQL service account (`[email protected]`) the `roles/cloudkms.cryptoKeyEncrypterDecrypter` role on the KMS key.
Cloud SQL requires explicit service account permissions to wrap and unwrap database encryption keys via Cloud KMS.

Anahtar Kavram

Provisioning databases with Customer-Managed Encryption Keys (CMEK) in Google Cloud
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru