Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ229

Ensuring data protection

Your organization formerly stored files in Cloud Storage using Google Managed Encryption Keys (GMEK), but has recently changed its internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently at minimal cost.

What should you do?

  • A Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
  • B Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
  • C Copy the files to a new bucket with CMEK enabled in a secondary region.
  • D Change the encryption type on the bucket to CMEK, and rewrite the objects.
Explanation

A bucket’s default CMEK applies when objects are written, but changing it does not retroactively encrypt existing objects with that key. Existing objects must be rewritten to apply CMEK; rewriting them in the same bucket after setting its default CMEK avoids unnecessary local transfers and a second bucket.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!