Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ129

Ensuring data protection

You need to follow Google-recommended practices for using envelope encryption and encrypting data at the application layer.

What should you do?

  • A Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
  • B Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
  • C Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
  • D Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
Explanation

For application-layer envelope encryption, generate the DEK locally and use it to encrypt the data. A Cloud KMS key serves as the KEK to wrap the DEK, and the encrypted data is stored with the wrapped DEK; the KEK remains in Cloud KMS.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!