Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ148

Ensuring data protection

You are moving an application to the cloud. The application must read data from a Cloud Storage bucket. Because of local regulatory requirements, you must keep the encryption key material entirely under your control and require a valid justification to access that key material.

What should you do?

  • A Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an IAM deny policy for unauthorized groups.
  • B Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket. Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
  • C Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
  • D Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
Explanation

Cloud External Key Manager allows encryption key material to remain in an external system, such as an on-premises HSM, rather than being stored in Google Cloud. With Key Access Justifications, requests include a reason code that the external key system can enforce by permitting only authorized justifications and rejecting all others.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!