A financial enterprise is designing a secure data analytics platform on Google Cloud to handle sensitive customer financial records. The platform must adhere to strict regulatory compliance and auditability standards: Mandatory CMEK Enforcement: All newly provisioned data processing and storage services must strictly require Customer-Managed Encryption Keys (CMEK) and block default encryption. Centralized Key Governance: Encryption keys must be centrally managed in a dedicated security project, restricting resource projects from using unauthorized keys. Least Privilege Access: Dedicated service agents for each managed service must have only the exact cryptographic permissions needed to encrypt and decrypt data at rest. Auditable Access: Cryptographic operations and periodic key checks must be traceable. Which architecture and configuration strategy should the data engineering and security teams implement?

Apply the `constraints/gcp.restrictNonCmekServices` organization policy constraint to deny non-CMEK resources, and apply `constraints/gcp.restrictCmekCryptoKeyProjects` to allow keys only from the dedicated security project. Grant the `roles/cloudkms.cryptoKeyEncrypterDecrypter` IAM role on each KMS key to the respective Google-managed service agent, and enable Cloud KMS Data Access audit logs.: ### What the Solution Is This architecture leverages native **Google Cloud Organization Policy constraints**, granular **IAM role assignments**, and **Cloud KMS Data Access audit logging** to establish an enterprise-grade cryptographic governance model using **Customer-Managed Encryption Keys (CMEK)**. ### How It Meets the Requirements - **Mandatory CMEK Enforcement**: Applying `constraints/gcp.restrictNonCmekServices` ensures the Resource Manager blocks the provisioning of any services that do not specify a customer-managed key. - **Centralized Key Governance**: Configuring `constraints/gcp.restrictCmekCryptoKeyProjects` restricts services to utilizing keys originating strictly from the designated central security project. - **Least Privilege Access**: Assigning `roles/cloudkms.cryptoKeyEncrypterDecrypter` exclusively to each service's Google-managed service agent (e.g., Dataproc Metastore, Firestore, BigQuery, or Cloud Storage service agents) allows cryptographic operations without granting administrative privileges. - **Auditable Access**: Enabling Cloud KMS Data Access audit logs records all `Encrypt`, `Decrypt`, and service health-check polling operations. ### Key Advantages and Capabilities - **Automated Guardrails**: Prevents accidental creation of unencrypted or default-encrypted data resources without custom CI/CD scripts. - **Cryptographic Boundary Control**: Centralizes key rings, key lifecycle policies, and rotation schedules inside a hardened security project. - **Instant Revocation Capability**: Disabling or destroying a key immediately revokes access to the underlying data across all dependent services. - **Comprehensive Compliance Auditability**: Captures key access activity directly in Cloud Logging for regulatory reporting. ### Why This Is Optimal This pattern uses declarative **Organization Policies** and built-in **Cloud KMS IAM roles**, enforcing compliance continuously across the organization hierarchy with zero custom maintenance overhead.

Design Cmek Cryptographic Control Compliance | professional-cloud-data-engineer

Design Cmek Cryptographic Control Compliance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is designing a secure data analytics platform on Google Cloud to handle sensitive customer financial records. The platform must adhere to strict regulatory compliance and auditability standards:

Mandatory CMEK Enforcement: All newly provisioned data processing and storage services must strictly require Customer-Managed Encryption Keys (CMEK) and block default encryption.
Centralized Key Governance: Encryption keys must be centrally managed in a dedicated security project, restricting resource projects from using unauthorized keys.
Least Privilege Access: Dedicated service agents for each managed service must have only the exact cryptographic permissions needed to encrypt and decrypt data at rest.
Auditable Access: Cryptographic operations and periodic key checks must be traceable.

Which architecture and configuration strategy should the data engineering and security teams implement?

Require developers to pass Customer-Supplied Encryption Keys (CSEK) via client headers for all managed databases and analytics services. Grant the roles/cloudkms.admin role to the default Compute Engine service account in each project, and rely on standard Cloud Logging Admin Activity logs.

Configure VPC Service Controls around each project without adding the Cloud KMS API. Grant individual user identities the roles/cloudkms.cryptoKeyEncrypterDecrypter role, and deploy Dataplex to automatically enforce encryption settings across data lakes.

Provision all resources using Google default encryption, and configure a scheduled Cloud Function to convert existing databases to CMEK. Grant roles/cloudkms.cryptoKeyViewer to the service agents and immediately destroy old key versions upon rotating keys in Cloud KMS.

Apply the constraints/gcp.restrictNonCmekServices organization policy constraint to deny non-CMEK resources, and apply constraints/gcp.restrictCmekCryptoKeyProjects to allow keys only from the dedicated security project. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter IAM role on each KMS key to the respective Google-managed service agent, and enable Cloud KMS Data Access audit logs.

Professional Cloud Data Engineer

Design Cmek Cryptographic Control Compliance

Related questions