Cmek Key Revocation Destruction Incident Response | Professional Cloud Security Engineer | StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cmek Key Revocation Destruction Incident Response

Section: Creating and managing encryption keys for CMEK and EKM (e.g., key rotation and revocation, key import).

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization uses Cloud KMS to manage Customer-Managed Encryption Keys (CMEK) protecting sensitive workloads, including Vertex AI RAG corpora. During an active security incident, the security operations team suspects that unauthorized callers are attempting to access protected data.

The incident response protocol mandates that the security engineer must immediately render all encrypted data irretrievable to all services and identities, maintain the ability to quickly restore decryption operations if the incident is a false alarm, and establish an irreversible cryptographic erasure path if key compromise is confirmed.

Which action should the security engineer take?

Change the CryptoKey purpose from Symmetric Encrypt/Decrypt to Asymmetric Sign, then remove the RAG Engine service agent.

Revoke the Cloud KMS Admin role from all service accounts and trigger an immediate 24-hour key rotation schedule.

Disable the active CryptoKeyVersion in Cloud KMS, and schedule it for destruction if key compromise is confirmed.

Permanently delete the parent KMS KeyRing resource using the Google Cloud CLI.

Professional Cloud Security Engineer

Cmek Key Revocation Destruction Incident Response

Related questions