A security engineer is designing a secrets management strategy in Google Cloud Secret Manager to support a compliance mandate. The requirements include: Secret payloads must be encrypted using Customer-Managed Encryption Keys (CMEK) via Cloud KMS. Secret payloads must adhere to strict data residency regulations by replicating exclusively across two specific regions: us-east4 and us-central1. The principle of least privilege must be enforced when authorizing Secret Manager to use the encryption keys. Which configuration meets these requirements?

Create a secret configured with user-managed replication targeting us-east4 and us-central1, specify a regional Cloud KMS key residing in the respective matching region for each replica, and grant the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to the Secret Manager service agent on both keys.: ### What User-Managed Replication with Regional CMEK Is **Secret Manager** supports two replication models: **automatic replication** (where Google determines data placement globally) and **user-managed replication** (where administrators explicitly designate replica locations). When customer-managed encryption keys (**CMEK**) are configured on user-managed replicas, each replica location must be mapped to a regional **Cloud Key Management Service (Cloud KMS)** symmetric key hosted within that exact geographic region. ### How It Meets the Requirements - **Data Residency Compliance:** By selecting **user-managed replication** with explicit targets (`us-east4` and `us-central1`), secret payloads are confined strictly to those designated regions rather than replicated dynamically across unapproved global data centers. - **Customer-Managed Encryption:** Specifying corresponding regional **Cloud KMS** symmetric keys ensures that each regional replica is encrypted at rest with independent, customer-controlled key material. - **Least Privilege Access:** Granting the **Cloud KMS CryptoKey Encrypter/Decrypter** (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) role specifically to the **Secret Manager Service Agent** (`service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com`) grants the exact cryptographic operations required to encrypt and decrypt secret payloads without administrative or overprivileged permissions. ### Key Advantages and Capabilities - **Regional Isolation:** Ensures cryptographic boundary alignment where the KMS key ring and secret replica reside within the same geographical location. - **Independent Lifecycle Control:** Allows revocation or rotation of regional keys independently if an incident occurs in a specific region. - **Full Auditability:** Every cryptographic operation generates **Cloud Audit Logs** under Cloud KMS Data Access logs, providing granular visibility into when secret versions are created and accessed. - **Compliance Enforcement:** Satisfies regional data sovereignty policies and regulatory frameworks such as GDPR, HIPAA, or FedRAMP High. ### Why This Is Optimal This architecture guarantees strict adherence to geographic data placement constraints while maintaining end-to-end customer cryptographic control. Binding the minimal required IAM role directly to the service agent preserves the principle of least privilege.

Secret Manager Cmek User Managed Replication | Professional Cloud Security Engineer

Secret Manager Cmek User Managed Replication

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing a secrets management strategy in Google Cloud Secret Manager to support a compliance mandate. The requirements include:

Secret payloads must be encrypted using Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Secret payloads must adhere to strict data residency regulations by replicating exclusively across two specific regions: us-east4 and us-central1.
The principle of least privilege must be enforced when authorizing Secret Manager to use the encryption keys.

Which configuration meets these requirements?

Create a secret configured with automatic replication, assign a regional Cloud KMS key in us-east4, and grant the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to the Compute Engine default service account.

Create a secret configured with automatic replication, assign a single multi-region Cloud KMS key in the us multi-region, and grant the Cloud KMS Admin (roles/cloudkms.admin) role to the Secret Manager default service account.

Create a secret configured with user-managed replication targeting us-east4 and us-central1, specify a single global Cloud KMS key for all replicas, and grant the Secret Manager Secret Accessor (roles/secretmanager.secretAccessor) role to the Secret Manager service agent.

Create a secret configured with user-managed replication targeting us-east4 and us-central1, specify a regional Cloud KMS key residing in the respective matching region for each replica, and grant the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to the Secret Manager service agent on both keys.

Professional Cloud Security Engineer

Secret Manager Cmek User Managed Replication

Related questions