Your enterprise is designing a secure data analytics platform on Google Cloud that processes sensitive data across Cloud Storage and BigQuery. Your compliance and security officers mandate strict cryptographic controls with the following specific requirements: Hardware Security: Cryptographic key material must reside and execute within FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs). Key Custody (BYOK): The organization must generate and escrow its own 256-bit symmetric encryption keys on-premises before securely introducing them into Google Cloud. Separation of Duties: Key administrators (cryptographic officers) must be able to manage key lifecycles and versions, but must not possess permissions to perform direct cryptographic data operations (encrypt/decrypt). Automated service agents must perform the cryptographic operations. Lifecycle Maintenance: The key must support scheduled periodic rotation to limit cryptographic exposure over time. Which strategy should the data engineering team implement to satisfy these architecture and compliance requirements?

Create a Cloud KMS key in a dedicated key project with the protection level set to HSM, configured with the `ImportOnly` flag and skipping initial version generation. Wrap the on-premises key using a Cloud KMS import job and import it as a new version. Grant `roles/cloudkms.admin` to cryptographic officers and `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the storage service agents. Implement automated pipeline workflows to generate, wrap, and import new key versions on schedule.: ### What the solution is This solution implements a robust **Customer-Managed Encryption Key (CMEK)** architecture utilizing **Cloud KMS with Cloud HSM** and **Key Import (Bring Your Own Key - BYOK)**. It establishes strict separation of duties and secure key lifecycle management for sensitive analytics workloads. ### How it meets all requirements - **Hardware Security:** Setting the key's protection level to `HSM` ensures that all cryptographic operations and key material are hosted inside **FIPS 140-2 Level 3** validated hardware security modules. - **Key Custody (BYOK):** Setting `ImportOnly: true` and `SkipInitialVersionCreation: true` ensures that Google Cloud does not generate default key material. The on-premises generated symmetric key is securely encrypted (wrapped) with a Cloud KMS public wrapping key in transit and unwrapped directly inside Cloud HSM. - **Separation of Duties:** Granting `roles/cloudkms.admin` to cryptographic officers allows them to manage key rings, metadata, and import jobs without granting `roles/cloudkms.cryptoKeyEncrypterDecrypter` (which is reserved for the automated BigQuery and Cloud Storage service agents). - **Lifecycle Maintenance:** Because Cloud KMS cannot automatically generate rotation material for imported keys, implementing external automation to regularly generate, wrap, and import new key versions satisfies the regular key rotation policy. ### Key advantages - **Zero Plaintext Exposure:** Key material is wrapped before transit and remains confined within Cloud HSM boundaries. - **Enforced Governance:** A dedicated key project with granular **Identity and Access Management (IAM)** roles prevents unauthorized data access and adheres to NIST SP 800-152 standards. - **Primary Version Promotion:** When a new imported key version is uploaded, it becomes the active primary version for subsequent CMEK encryption while older versions remain available for decryption. ### Why this is optimal This approach aligns strictly with enterprise compliance standards by maintaining on-premises key generation and escrow while leveraging Google Cloud's managed HSM infrastructure and automated service agent encryption.

Manage Cloud Hsm Byok Lifecycle Iam | professional-cloud-data-engineer

Manage Cloud Hsm Byok Lifecycle Iam

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise is designing a secure data analytics platform on Google Cloud that processes sensitive data across Cloud Storage and BigQuery. Your compliance and security officers mandate strict cryptographic controls with the following specific requirements:

Hardware Security: Cryptographic key material must reside and execute within FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs).
Key Custody (BYOK): The organization must generate and escrow its own 256-bit symmetric encryption keys on-premises before securely introducing them into Google Cloud.
Separation of Duties: Key administrators (cryptographic officers) must be able to manage key lifecycles and versions, but must not possess permissions to perform direct cryptographic data operations (encrypt/decrypt). Automated service agents must perform the cryptographic operations.
Lifecycle Maintenance: The key must support scheduled periodic rotation to limit cryptographic exposure over time.

Which strategy should the data engineering team implement to satisfy these architecture and compliance requirements?

Create a Cloud KMS key in a dedicated key project with the protection level set to HSM, configured with the ImportOnly flag and skipping initial version generation. Wrap the on-premises key using a Cloud KMS import job and import it as a new version. Grant roles/cloudkms.admin to cryptographic officers and roles/cloudkms.cryptoKeyEncrypterDecrypter to the storage service agents. Implement automated pipeline workflows to generate, wrap, and import new key versions on schedule.

Create a Cloud KMS key with the protection level set to SOFTWARE, set an automatic rotation period of 90 days, and import the on-premises key material into version 1. Assign roles/cloudkms.admin to cryptographic officers and roles/cloudkms.cryptoKeyEncrypterDecrypter to service agents.

Deploy Cloud KMS Autokey in the data project folder to automatically create and provision HSM keys for BigQuery and Cloud Storage. Grant roles/owner on the project to cryptographic officers to oversee key and data lifecycles.

Use Customer-Supplied Encryption Keys (CSEK) by transmitting the raw AES-256 key directly inside API request headers for Cloud Storage and BigQuery operations. Grant roles/cloudkms.admin and roles/cloudkms.cryptoKeyEncrypterDecrypter to the cryptographic officers to manage the lifecycle.

Professional Cloud Data Engineer

Manage Cloud Hsm Byok Lifecycle Iam

Related questions