professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A data engineering team is designing an automated ingestion pipeline that processes sensitive transaction files exceeding 50 MB before storing them in Google Cloud. The organization's security policy requires column- and application-layer encryption managed centrally through Cloud Key Management Service (Cloud KMS).
During architectural review, the team observes that the Cloud KMS Encrypt API rejects direct encryption requests exceeding 64 KiB.
Which cryptographic key management strategy should the team implement to encrypt these large payloads securely and efficiently?
Envelope encryption is a multi-layered cryptographic approach where actual application data is encrypted with a locally generated Data Encryption Key (DEK), and that DEK is subsequently encrypted (wrapped) using a centrally managed Key Encryption Key (KEK) stored in Cloud Key Management Service (Cloud KMS).
StudyCerts
StudyCertsEncrypt/Decrypt) has a hard input size limit of 64 KiB. By encrypting the large 50 MB payload locally with a symmetric DEK (such as AES-256-GCM), the workload avoids sending large data streams over the network to the KMS API.roles/cloudkms.cryptoKeyEncrypterDecrypter on the KEK.Envelope encryption is Google Cloud's standard pattern for encrypting data at scale. It perfectly balances local compute performance with centralized KMS governance, adhering to security standards without hitting API payload size ceilings.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.