Examkin

Soru

Zorluk: KolayData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise cloud security team needs to encrypt data stored in a Cloud Storage bucket. Security compliance mandates that the enterprise must retain complete control over key lifecycle management, including key rotation and revocation using Google Cloud APIs, without the overhead of manually managing and supplying raw cryptographic keys for every data access request. Which encryption approach should the cloud architect recommend?

  1. Use Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.Cevap
  2. B
    Use Customer-Supplied Encryption Keys (CSEK) passed with every storage API request.
  3. C
    Use Google-default encryption with service-managed keys.
  4. D
    Use Cloud KMS and grant all storage users the primitive Owner IAM role on the key ring.

Cevap

Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.
Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow organizations to maintain control over key creation, rotation, and revocation, while allowing Google Cloud services to automatically encrypt and decrypt data at rest.

Adım Adım Çözüm

1
Identify key lifecycle control requirement
The requirement demands customer management of key generation, rotation, and revocation policies.
Google-default keys do not provide direct customer lifecycle management.
2
Evaluate operational burden constraints
The requirement specifies avoiding manual key transmission/supplying per API call.
Customer-Supplied Encryption Keys (CSEK) force the caller to manage raw keys and provide them with every operation, whereas Customer-Managed Encryption Keys (CMEK) integrate natively with Cloud KMS and GCP storage services.
3
Select the appropriate encryption key model
Cloud KMS CMEK satisfies customer control over key lifecycles without requiring raw key handling.
CMEK uses Cloud KMS to manage keys while GCP services handle data encryption seamlessly.

Anahtar Kavram

Customer-Managed Encryption Keys (CMEK) vs Customer-Supplied Encryption Keys (CSEK)
Tahmini Süre:45s
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru