Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ161

Ensuring data protection

You must implement an encryption-at-rest strategy that protects sensitive data while reducing key-management complexity for non-sensitive data. Your solution must meet these requirements:

  • Schedule key rotation for sensitive data.
  • Control the region in which encryption keys for sensitive data are stored.
  • Minimize latency when accessing encryption keys for both sensitive and non-sensitive data.

What should you do?

  • A Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
  • B Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.
  • C Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
  • D Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
Explanation

Google default encryption protects non-sensitive data without requiring customer-managed key administration. Cloud KMS lets you create keys in a selected Cloud KMS location and configure automatic rotation schedules for symmetric encryption keys. Cloud EKM requires communication with an external key manager, for which Google documents geographic-latency and connectivity considerations; it is therefore less suitable when minimizing key-access latency is required.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!