Your enterprise is designing a secure data analytics platform on Google Cloud that processes sensitive data across Cloud Storage and BigQuery. Your compliance and security officers mandate strict cryptographic controls with the following specific requirements: Hardware Security: Cryptographic key material must reside and execute within FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs). Key Custody (BYOK): The organization must generate and escrow its own 256-bit symmetric encryption keys on-premises before securely introducing them into Google Cloud. Separation of Duties: Key administrators (cryptographic officers) must be able to manage key lifecycles and versions, but must not possess permissions to perform direct cryptographic data operations (encrypt/decrypt). Automated service agents must perform the cryptographic operations. Lifecycle Maintenance: The key must support scheduled periodic rotation to limit cryptographic exposure over time. Which strategy should the data engineering team implement to satisfy these architecture and compliance requirements?

Create a Cloud KMS key in a dedicated key project with the protection level set to HSM, configured with the `ImportOnly` flag and skipping initial version generation. Wrap the on-premises key using a Cloud KMS import job and import it as a new version. Grant `roles/cloudkms.admin` to cryptographic officers and `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the storage service agents. Implement automated pipeline workflows to generate, wrap, and import new key versions on schedule.: What the solution is This solution implements a robust Customer-Managed Encryption Key (CMEK) architecture utilizing Cloud KMS with Cloud HSM and Key Import (Bring Your Own Key - BYOK). It establishes strict separation of duties and secure key lifecycle management for sensitive analytics workloads. How it meets all requirements Hardware Security: Setting the key's protection level to HSM ensures that all cryptographic operations and key material are hosted inside FIPS 140-2 Level 3 validated hardware security modules. Key Custody (BYOK): Setting ImportOnly: true and SkipInitialVersionCreation: true ensures that Google Cloud does not generate default key material. The on-premises generated symmetric key is securely encrypted (wrapped) with a Cloud KMS public wrapping key in transit and unwrapped directly inside Cloud HSM. Separation of Duties: Granting roles/cloudkms.admin to cryptographic officers allows them to manage key rings, metadata, and import jobs without granting roles/cloudkms.cryptoKeyEncrypterDecrypter (which is reserved for the automated BigQuery and Cloud Storage service agents). Lifecycle Maintenance: Because Cloud KMS cannot automatically generate rotation material for imported keys, implementing external automation to regularly generate, wrap, and import new key versions satisfies the regular key rotation policy. Key advantages Zero Plaintext Exposure: Key material is wrapped before transit and remains confined within Cloud HSM boundaries. Enforced Governance: A dedicated key project with granular Identity and Access Management (IAM) roles prevents unauthorized data access and adheres to NIST SP 800-152 standards. Primary Version Promotion: When a new imported key version is uploaded, it becomes the active primary version for subsequent CMEK encryption while older versions remain available for decryption. Why this is optimal This approach aligns strictly with enterprise compliance standards by maintaining on-premises key generation and escrow while leveraging Google Cloud's managed HSM infrastructure and automated service agent encryption.

StudyCerts

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Manage Cloud Hsm Byok Lifecycle Iam

Section: Data security (encryption and key management)

Your enterprise is designing a secure data analytics platform on Google Cloud that processes sensitive data across Cloud Storage and BigQuery. Your compliance and security officers mandate strict cryptographic controls with the following specific requirements:

Hardware Security: Cryptographic key material must reside and execute within FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs).
Key Custody (BYOK): The organization must generate and escrow its own 256-bit symmetric encryption keys on-premises before securely introducing them into Google Cloud.
Separation of Duties: Key administrators (cryptographic officers) must be able to manage key lifecycles and versions, but must not possess permissions to perform direct cryptographic data operations (encrypt/decrypt). Automated service agents must perform the cryptographic operations.
Lifecycle Maintenance: The key must support scheduled periodic rotation to limit cryptographic exposure over time.

Which strategy should the data engineering team implement to satisfy these architecture and compliance requirements?

Use Customer-Supplied Encryption Keys (CSEK) by transmitting the raw AES-256 key directly inside API request headers for Cloud Storage and BigQuery operations. Grant roles/cloudkms.admin and roles/cloudkms.cryptoKeyEncrypterDecrypter to the cryptographic officers to manage the lifecycle.

Deploy Cloud KMS Autokey in the data project folder to automatically create and provision HSM keys for BigQuery and Cloud Storage. Grant roles/owner on the project to cryptographic officers to oversee key and data lifecycles.

Create a Cloud KMS key in a dedicated key project with the protection level set to HSM, configured with the ImportOnly flag and skipping initial version generation. Wrap the on-premises key using a Cloud KMS import job and import it as a new version. Grant roles/cloudkms.admin to cryptographic officers and roles/cloudkms.cryptoKeyEncrypterDecrypter to the storage service agents. Implement automated pipeline workflows to generate, wrap, and import new key versions on schedule.

Create a Cloud KMS key with the protection level set to SOFTWARE, set an automatic rotation period of 90 days, and import the on-premises key material into version 1. Assign roles/cloudkms.admin to cryptographic officers and roles/cloudkms.cryptoKeyEncrypterDecrypter to service agents.

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Manage Cloud Hsm Byok Lifecycle Iam

Section: Data security (encryption and key management)

Hardware Security: Cryptographic key material must reside and execute within FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs).
Key Custody (BYOK): The organization must generate and escrow its own 256-bit symmetric encryption keys on-premises before securely introducing them into Google Cloud.
Separation of Duties: Key administrators (cryptographic officers) must be able to manage key lifecycles and versions, but must not possess permissions to perform direct cryptographic data operations (encrypt/decrypt). Automated service agents must perform the cryptographic operations.
Lifecycle Maintenance: The key must support scheduled periodic rotation to limit cryptographic exposure over time.

Which strategy should the data engineering team implement to satisfy these architecture and compliance requirements?

Explanations

What the solution is

This solution implements a robust Customer-Managed Encryption Key (CMEK) architecture utilizing Cloud KMS with Cloud HSM and Key Import (Bring Your Own Key - BYOK). It establishes strict separation of duties and secure key lifecycle management for sensitive analytics workloads.

How it meets all requirements

Hardware Security: Setting the key's protection level to HSM ensures that all cryptographic operations and key material are hosted inside FIPS 140-2 Level 3 validated hardware security modules.
Key Custody (BYOK): Setting ImportOnly: true and SkipInitialVersionCreation: true ensures that Google Cloud does not generate default key material. The on-premises generated symmetric key is securely encrypted (wrapped) with a Cloud KMS public wrapping key in transit and unwrapped directly inside Cloud HSM.
Separation of Duties: Granting roles/cloudkms.admin to cryptographic officers allows them to manage key rings, metadata, and import jobs without granting roles/cloudkms.cryptoKeyEncrypterDecrypter (which is reserved for the automated BigQuery and Cloud Storage service agents).
Lifecycle Maintenance: Because Cloud KMS cannot automatically generate rotation material for imported keys, implementing external automation to regularly generate, wrap, and import new key versions satisfies the regular key rotation policy.

Key advantages

Zero Plaintext Exposure: Key material is wrapped before transit and remains confined within Cloud HSM boundaries.
Enforced Governance: A dedicated key project with granular Identity and Access Management (IAM) roles prevents unauthorized data access and adheres to NIST SP 800-152 standards.
Primary Version Promotion: When a new imported key version is uploaded, it becomes the active primary version for subsequent CMEK encryption while older versions remain available for decryption.

Why this is optimal

This approach aligns strictly with enterprise compliance standards by maintaining on-premises key generation and escrow while leveraging Google Cloud's managed HSM infrastructure and automated service agent encryption.

View source documentation

Professional Cloud Data Engineer

Manage Cloud Hsm Byok Lifecycle Iam

Professional Cloud Data Engineer

Manage Cloud Hsm Byok Lifecycle Iam

What the solution is

How it meets all requirements

Key advantages

Why this is optimal

Related questions