Examkin

Soru

Zorluk: ZorData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

A regulatory compliance framework requires a media streaming enterprise to maintain full control over the lifecycle and rotation schedules of encryption keys protecting sensitive API secrets stored in Secret Manager. The regulatory standard mandates that keys must reside in FIPS 140-2 Level 3 validated hardware security modules (HSMs) managed within Google Cloud, and key management administrative duties must be strictly separated from key usage permissions assigned to services. Which security architecture fulfills these compliance and least-privilege requirements?

  1. Configure Secret Manager to use Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM, assigning the Cloud KMS Admin role (roles/cloudkms.admin) to the security operations team and the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the Secret Manager Service Agent.Cevap
  2. B
    Generate raw 256-bit AES keys on-premises and pass them as Customer-Supplied Encryption Keys (CSEK) in API headers for every Secret Manager creation and retrieval request, managed directly by application developers.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) in Cloud KMS backed by Cloud HSM, and grant the Project Editor primitive role (roles/editor) to both the security operations team and the Secret Manager Service Agent.
  4. D
    Retain Google-default encryption for Secret Manager secrets and rely on Identity and Access Management (IAM) conditional policies to prevent unauthorized modification of key rotation parameters.

Cevap

Configure Secret Manager to use Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM, assigning the Cloud KMS Admin role (roles/cloudkms.admin) to the security operations team and the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the Secret Manager Service Agent.
Configuring Secret Manager to use Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM satisfies compliance mandates for FIPS 140-2 Level 3 hardware key protection while allowing the enterprise to manage key lifecycle and rotation. Granting the Cloud KMS Admin role to security administrators and the Cloud KMS CryptoKey Encrypter/Decrypter role to the Secret Manager Service Agent implements strict separation of duties and least privilege.

Adım Adım Çözüm

1
Select the appropriate Google Cloud encryption key deployment model based on compliance specifications.
Identify Cloud KMS with Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM as the solution that meets FIPS 140-2 Level 3 hardware security module requirements without requiring manual handling of raw key material.
Google-default encryption does not give customers key lifecycle control, while CSEK forces raw key management on the client rather than leveraging cloud-managed HSM infrastructure.
2
Configure the Identity and Access Management (IAM) permission structure to enforce separation of duties.
Grant the administrative role `roles/cloudkms.admin` to the security operations team and `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Secret Manager service agent (`service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com`).
Separating administrative key management from cryptographic operation permissions ensures least privilege, and granting permissions to the service agent enables Secret Manager to perform encryption/decryption on behalf of users.

Anahtar Kavram

Customer-Managed Encryption Keys (CMEK) with Cloud HSM and IAM Least Privilege
Bu soruyu puanla

Konular

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

Bu konudan daha fazla soru