Examkin

Soru

Zorluk: ZorData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A financial technology company stores analytical datasets containing sensitive customer transaction records in Google BigQuery. Corporate security policy mandates the use of Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS. To strictly enforce separation of duties and least privilege, security administrators must manage the key lifecycle without having permissions to query BigQuery dataset contents, while data analysts must run queries without holding permissions to manage or directly invoke Cloud KMS key operations. Furthermore, the BigQuery service must perform encryption and decryption operations automatically on behalf of the analysts. Which architecture and IAM configuration correctly meets these requirements?

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) specifically to the BigQuery Service Agent, restrict Cloud KMS administrative roles to the security team, and grant BigQuery Data Viewer and Job User roles to the data analysts without Cloud KMS permissions.Cevap
  2. B
    Supply raw 256-bit AES Customer-Supplied Encryption Keys (CSEK) within every BigQuery API query request header, and grant data analysts the Cloud KMS Admin role so they can rotate the encryption keys dynamically.
  3. C
    Grant the Editor primitive IAM role (roles/editor) to the BigQuery Service Agent on the Cloud KMS KeyRing and grant the Owner primitive IAM role (roles/owner) to data analysts to ensure all underlying encryption operations inherit access.
  4. D
    Grant the Cloud KMS CryptoKey Encrypter/Decrypter role directly to data analysts, and rely exclusively on IAM permissions while omitting VPC Service Controls, assuming IAM alone prevents unauthorized data exfiltration across storage boundaries.

Cevap

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the BigQuery Service Agent, keep Cloud KMS administration restricted to security administrators, and grant data analysts BigQuery query/viewer access without key permissions.
The correct solution grants the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly to the BigQuery Service Agent. This allows BigQuery to handle transparent data encryption and decryption during query execution. Security administrators retain key management permissions, and data analysts receive standard BigQuery data viewer and job user permissions, achieving strict separation of duties and least privilege.

Adım Adım Çözüm

1
Identify the service account executing CMEK encryption/decryption operations for BigQuery.
Determine that the Google-managed BigQuery Service Agent ([email protected]) requires permission to use the Cloud KMS key.
When configuring CMEK, GCP services encrypt and decrypt data using their dedicated service agents on behalf of users.
2
Apply the principle of least privilege to Cloud KMS permissions.
Grant roles/cloudkms.cryptoKeyEncrypterDecrypter to the BigQuery Service Agent on the target key.
This provides the service agent with minimal necessary permissions to protect and unprotect data blocks.
3
Establish separation of duties for human users.
Assign Cloud KMS Admin roles exclusively to security administrators and assign BigQuery Data Viewer / Job User roles to analysts.
Prevents analysts from managing or directly reading encryption key material, while preventing security personnel from accessing sensitive analytical data within BigQuery datasets.

Anahtar Kavram

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru