An enterprise cloud security architect is standardizing the data encryption strategy across Google Cloud workloads to satisfy varying regulatory and security control mandates. Match each organizational key control requirement on the left with its corresponding Google Cloud encryption mechanism on the right.
- Requirement for full key governance where raw AES-256 keys are supplied directly in API request headers and purged from Google Cloud memory immediately after cryptographic operations.Customer-Supplied Encryption Keys (CSEK)
- Mandate to enforce automated encryption at rest across standard resources with zero key lifecycle management overhead, utilizing Google-managed key infrastructure.Google-default encryption
- Regulatory requirement to retain root cryptographic key material outside of Google Cloud infrastructure in a third-party key management system.Cloud External Key Manager (Cloud EKM)
- Mandate to control key rotation schedules, key access permissions, and auditing while leveraging key infrastructure hosted natively inside Google Cloud.Customer-Managed Encryption Keys (CMEK) via Cloud KMS
Cevap
Supplying raw keys in API headers pairs with Customer-Supplied Encryption Keys (CSEK); zero-overhead automated encryption pairs with Google-default encryption; retaining keys in an external third-party HSM pairs with Cloud External Key Manager (Cloud EKM); native Cloud KMS key administration pairs with Customer-Managed Encryption Keys (CMEK).
Each organizational constraint maps directly to a distinct GCP encryption tier: supplying raw keys transiently in headers matches CSEK; hands-off automatic protection matches Google-default encryption; external off-cloud key storage matches Cloud EKM; and native key control and access policy management matches CMEK via Cloud KMS.
Adım Adım Çözüm
Anahtar Kavram
Classification of Google Cloud Encryption Modes (Google-default, CMEK, CSEK, Cloud EKM)