Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ149

Ensuring data protection

A customer’s internal security team must manage its own encryption keys to encrypt data in Cloud Storage and has chosen customer-supplied encryption keys (CSEK).

How should the team perform this task?

  • A Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.
  • B Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.
  • C Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.
  • D Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.
Explanation

Customer-supplied encryption keys are provided with each Cloud Storage operation so Cloud Storage can encrypt the uploaded object without retaining or managing the raw key. A command-line upload tool can be configured to supply the CSEK; the Google Cloud Console does not support uploading objects with CSEK.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!