Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ302

Ensuring data protection

Your privacy team employs crypto-shredding—deleting encryption keys—as a method for deleting personally identifiable information (PII). You must implement this approach on Google Cloud while continuing to use most platform services and minimizing operational overhead. What should you do?

  • A Use client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises.
  • B Use Cloud External Key Manager to delete specific encryption keys.
  • C Use customer-managed encryption keys to delete specific encryption keys.
  • D Use Google default encryption to delete specific encryption keys.
Explanation

Customer-managed encryption keys (CMEK) let you control Cloud KMS key versions, including their destruction. Data protected by a destroyed key version can no longer be decrypted, enabling selective deletion through crypto-shredding. CMEK integrates natively with many Google Cloud services, avoiding the added operational burden of client-side encryption or an external key-management system.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!