Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ96

Ensuring data protection

You are implementing data protection by design in accordance with GDPR requirements. During design reviews, you are told to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you select for this implementation?

  • A Cloud External Key Manager
  • B Customer-managed encryption keys
  • C Customer-supplied encryption keys
  • D Google default encryption
Explanation

Customer-managed encryption keys (CMEK) let an organization control Cloud KMS keys used to encrypt data at rest. CMEK is supported across the listed services, including Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub, making it the appropriate common key-management approach.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!