Gcp Default Encryption Architecture Limitations

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is migrating general application workloads, secrets, and log data to Google Cloud services such as Cloud Storage and Secret Manager. The enterprise's security policy mandates that all data at rest must satisfy NIST-approved baseline encryption standards, while the operations team wants to avoid the administrative burden of provisioning and managing custom key infrastructure.

Which statement accurately evaluates the underlying architecture, baseline security capabilities, and operational limitations of Google default encryption (Google-managed encryption keys)?

Google default encryption encrypts storage volumes using a single static root key provisioned inside Cloud KMS, allowing customers to view key access events in Cloud Audit Logs while delegating key lifecycle management to Google.

Google default encryption automatically applies AES-256 using envelope encryption via internal Keystore systems with zero customer overhead, but it offers no granular key-access audit logging, manual key rotation control, or ability to perform cryptographic erasure.

Google default encryption requires activating the constraints/gcp.restrictCmekCryptoKeyProjects organization policy, which restricts key storage to software protection levels within the local deployment region.

Google default encryption performs client-side data encryption prior to transit using the open-source Tink library, ensuring that cleartext data is never accessible to Google's internal production fleet.

Professional Cloud Security Engineer

Gcp Default Encryption Architecture Limitations

Related questions