Unlock the power of your data in the cloud! Get hands-on with Google Cloud's core data services like BigQuery and Looker to validate your practical skills in data ingestion, analysis, and management, and earn your Associate Data Practitioner certification!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A data engineering team needs to implement envelope encryption to protect sensitive data files stored across multiple client environments. The architecture requires that client applications encrypt a locally generated Data Encryption Key (DEK) without granting them direct access to decrypt data or manage the private key.
Which workflow correctly describes how Cloud KMS asymmetric keys should be used to protect the DEK?
Asymmetric encryption in Google Cloud Key Management Service (Cloud KMS) uses a mathematically linked public and private key pair. In this model, the public key is made available to encrypt plaintext data, while the corresponding private key is kept secure within Cloud KMS and used exclusively for decryption operations.
StudyCerts
StudyCertsroles/cloudkms.publicKeyViewer), preventing them from decrypting data.This workflow allows decentralized encryption across numerous distributed clients without exposing sensitive decryption keys. It keeps private key material centralized and safeguarded within Cloud KMS while supporting high-throughput local data encryption.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.