Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Associate Data Practitioner practice bank has 1,132 more like it. Try 10 free: instant score, no account.
A financial services organization is designing a data storage architecture on Google Cloud. The company's compliance policy mandates that the security team must maintain direct administrative control over encryption key lifecycles—including key creation, rotation schedules, and immediate key revocation—directly through Google Cloud's centralized key management service, while allowing cloud storage services to automatically handle encryption and decryption operations.
Which encryption key management strategy should the organization implement?
Customer-supplied encryption keys (CSEK) and client-side encryption require the customer to create, hold, and manage cryptographic keys entirely outside of Google Cloud's centralized key management service. In client-side encryption, data is encrypted on-premises or at the client tier before transmission to Google Cloud, meaning Google Cloud never stores, manages, or has knowledge of the encryption keys.
The organization had a strict regulatory requirement that cloud providers must have zero technical access or knowledge of encryption keys under any circumstance, and the team was prepared to encrypt all data prior to transmission.
Asymmetric signing keys are cryptographic key pairs (consisting of a public and private key, commonly based on elliptic curve algorithms like EC_SIGN_P384_SHA384 or RSA) designed specifically for digital signatures, data integrity verification, and non-repudiation, rather than encrypting bulk stored data at rest.
The organization needed to generate verifiable digital signatures for software release artifacts, container images, or code authentication to prove authenticity and data integrity.
Customer-managed encryption keys (CMEK) allow organizations to control and manage the symmetric encryption keys used to protect data at rest within supported Google Cloud services. The cryptographic keys reside in and are managed through Cloud Key Management Service (Cloud KMS) or Cloud HSM, giving the customer control over administrative operations while allowing the target Google Cloud service to use the keys via service accounts.
CMEK provides the perfect balance between regulatory compliance and operational simplicity. Unlike Google-managed keys, the customer maintains complete authority over key lifecycle and revocation. Unlike client-side or customer-supplied keys, CMEK integrates natively with GCP services without requiring developers to manage key material during every API request or handle encryption client-side.
Google-managed encryption keys (GMEK) represent the default server-side encryption applied automatically to all customer data at rest across Google Cloud services. Google automatically handles key generation, distribution, rotation, and storage using internal hardened key management systems with AES-256 encryption without requiring any user setup.
The organization required standard, baseline encryption at rest with zero operational overhead, no additional key management costs, and no requirement for customer control over key lifecycles.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated