Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ259

Ensuring data protection

An organization requires complete control over the keys used to encrypt data at rest in its Google Cloud environments. The keys must be generated and stored outside Google, while integrating with numerous Google services, including BigQuery.

What should you do?

  • A Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.
  • B Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
  • C Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
  • D Create a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
Explanation

Cloud External Key Manager (Cloud EKM) lets Google Cloud services use keys that remain managed in a supported external key-management system, including an external HSM. The external key material is never stored in or sent to Google, and BigQuery is among the services that support Cloud EKM keys.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!