Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ84

Ensuring data protection

A global defense company is migrating top-secret classified data to BigQuery and Cloud Storage. National-security regulations require that the master encryption-key material never leave accredited on-premises cryptographic hardware. The company must retain the unilateral ability to revoke data access independently of any cloud provider. What should it do?

  • A Use customer-managed encryption keys (CMEKs) for the BigQuery datasets and Cloud Storage buckets. Store the keys in Cloud Key Management Service (Cloud KMS).
  • B Use customer-supplied encryption keys (CSEKs) by providing your own encryption keys with each data operation in Cloud Storage and BigQuery.
  • C Import existing on-premises master encryption keys into Cloud Key Management Service (Cloud KMS). Use the imported keys for BigQuery and Cloud Storage encryption.
  • D Configure Cloud External Key Manager (Cloud EKM) for the BigQuery datasets and Cloud Storage buckets. Integrate EKM with your existing on-premises hardware security modules (HSMs).
Explanation

Cloud External Key Manager lets Google Cloud services use keys managed in an external key manager, such as on-premises HSMs, without sending the external key material to Google. Access can be revoked in the external key manager at any time, which prevents use of the protected data independently of the cloud provider. Cloud EKM supports CMEK integrations for BigQuery and Cloud Storage.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!