Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Enforcing CMEK with Organization Policy Constraints
Free sample question, answered and explained below. The Professional Data Engineer practice bank has 1,353 more like it. Try 10 free: instant score, no account.
A financial enterprise is designing a secure data analytics platform on Google Cloud to handle sensitive customer financial records. The platform must adhere to strict regulatory compliance and auditability standards:
- Mandatory CMEK Enforcement: All newly provisioned data processing and storage services must strictly require Customer-Managed Encryption Keys (CMEK) and block default encryption.
- Centralized Key Governance: Encryption keys must be centrally managed in a dedicated security project, restricting resource projects from using unauthorized keys.
- Least Privilege Access: Dedicated service agents for each managed service must have only the exact cryptographic permissions needed to encrypt and decrypt data at rest.
- Auditable Access: Cryptographic operations and periodic key checks must be traceable.
Which architecture and configuration strategy should the data engineering and security teams implement?
Explanations
Configure VPC Service Controls around each project without adding the Cloud KMS API. Grant individual user identities the roles/cloudkms.cryptoKeyEncrypterDecrypter role, and deploy Dataplex to automatically enforce encryption settings across data lakes.
Configure VPC Service Controls around each project without adding the Cloud KMS API. Grant individual user identities the roles/cloudkms.cryptoKeyEncrypterDecrypter role, and deploy Dataplex to automatically enforce encryption settings across data lakes.
What the Option Is
This configuration relies on perimeter network isolation using VPC Service Controls while granting cryptographic roles to human user accounts and attempting to manage encryption via Dataplex.
Why It Doesn't Meet the Requirement
- VPC Service Controls Misconfiguration: If a service operates inside a VPC Service Controls perimeter and utilizes CMEK, the Cloud Key Management Service (Cloud KMS) API must explicitly be allowed in the service perimeter; omitting it causes all key requests to be blocked.
- Incorrect Identity Grants: Managed services perform data-at-rest encryption asynchronously under their Google-managed service agents, not user identities. Granting permissions to end users does not allow background storage systems to decrypt records.
- Missing Guardrails: Dataplex organizes metadata and quality rules but does not replace Organization Policy constraints for blocking non-CMEK resource provisioning.
Key Limitations
- Service Disruption: Omitting Cloud KMS from perimeter controls causes immediate authentication and decryption failures.
- Operational Overhead: Managing cryptographic grants at the user level introduces credential exposure and fails service-to-service automation.
This Answer Would Be Correct If
End users were manually calling Cloud KMS client-side encryption libraries directly from their local workstations.
Provision all resources using Google default encryption, and configure a scheduled Cloud Function to convert existing databases to CMEK. Grant roles/cloudkms.cryptoKeyViewer to the service agents and immediately destroy old key versions upon rotating keys in Cloud KMS.
Provision all resources using Google default encryption, and configure a scheduled Cloud Function to convert existing databases to CMEK. Grant roles/cloudkms.cryptoKeyViewer to the service agents and immediately destroy old key versions upon rotating keys in Cloud KMS.
What the Option Is
This option relies on retroactive conversion of resources using automated scripts, read-only key access roles, and immediate key destruction during key rotation.
Why It Doesn't Meet the Requirement
- Existing Resource Limitations: Most Google Cloud managed services (such as Cloud SQL, Dataproc Metastore, and Firestore) cannot be converted to CMEK after creation; CMEK must be specified at resource creation time.
- Incorrect IAM Role: The
roles/cloudkms.cryptoKeyViewerrole only grants metadata read permissions and cannot encrypt or decrypt data, causing all cryptographic calls to fail. - Immediate Key Destruction: In Cloud KMS, rotating a key creates a new primary version for future writes, but existing data remains encrypted with prior key versions. Destroying old key versions immediately renders existing data permanently unrecoverable.
Key Limitations
- Data Loss: Immediate key version destruction breaks active reads for historical data.
- Reactive Rather than Preventive: Scheduled scripts cannot prevent unencrypted data ingestion from occurring in the interim.
This Answer Would Be Correct If
Services supported in-place retroactive encryption and you only needed metadata inspection rather than operational data encryption.
Apply the constraints/gcp.restrictNonCmekServices organization policy constraint to deny non-CMEK resources, and apply constraints/gcp.restrictCmekCryptoKeyProjects to allow keys only from the dedicated security project. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter IAM role on each KMS key to the respective Google-managed service agent, and enable Cloud KMS Data Access audit logs.
Apply the constraints/gcp.restrictNonCmekServices organization policy constraint to deny non-CMEK resources, and apply constraints/gcp.restrictCmekCryptoKeyProjects to allow keys only from the dedicated security project. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter IAM role on each KMS key to the respective Google-managed service agent, and enable Cloud KMS Data Access audit logs.
What the Solution Is
This architecture leverages native Google Cloud Organization Policy constraints, granular IAM role assignments, and Cloud KMS Data Access audit logging to establish an enterprise-grade cryptographic governance model using Customer-Managed Encryption Keys (CMEK).
How It Meets the Requirements
- Mandatory CMEK Enforcement: Applying
constraints/gcp.restrictNonCmekServicesensures the Resource Manager blocks the provisioning of any services that do not specify a customer-managed key. - Centralized Key Governance: Configuring
constraints/gcp.restrictCmekCryptoKeyProjectsrestricts services to utilizing keys originating strictly from the designated central security project. - Least Privilege Access: Assigning
roles/cloudkms.cryptoKeyEncrypterDecrypterexclusively to each service's Google-managed service agent (e.g., Dataproc Metastore, Firestore, BigQuery, or Cloud Storage service agents) allows cryptographic operations without granting administrative privileges. - Auditable Access: Enabling Cloud KMS Data Access audit logs records all
Encrypt,Decrypt, and service health-check polling operations.
Key Advantages and Capabilities
- Automated Guardrails: Prevents accidental creation of unencrypted or default-encrypted data resources without custom CI/CD scripts.
- Cryptographic Boundary Control: Centralizes key rings, key lifecycle policies, and rotation schedules inside a hardened security project.
- Instant Revocation Capability: Disabling or destroying a key immediately revokes access to the underlying data across all dependent services.
- Comprehensive Compliance Auditability: Captures key access activity directly in Cloud Logging for regulatory reporting.
Why This Is Optimal
This pattern uses declarative Organization Policies and built-in Cloud KMS IAM roles, enforcing compliance continuously across the organization hierarchy with zero custom maintenance overhead.
Require developers to pass Customer-Supplied Encryption Keys (CSEK) via client headers for all managed databases and analytics services. Grant the roles/cloudkms.admin role to the default Compute Engine service account in each project, and rely on standard Cloud Logging Admin Activity logs.
Require developers to pass Customer-Supplied Encryption Keys (CSEK) via client headers for all managed databases and analytics services. Grant the roles/cloudkms.admin role to the default Compute Engine service account in each project, and rely on standard Cloud Logging Admin Activity logs.
What the Option Is
This strategy attempts to use Customer-Supplied Encryption Keys (CSEK) across all data services while granting broad Cloud KMS Admin permissions to the default Compute Engine service account.
Why It Doesn't Meet the Requirement
- Managed Service Incompatibility: CSEK is only supported on select services like Cloud Storage and Compute Engine disks; high-level managed database and metadata services (such as Firestore, Dataplex, or Dataproc Metastore) require CMEK integrated with Cloud KMS.
- Violation of Least Privilege: Granting
roles/cloudkms.adminallows service accounts to create, delete, and alter keys rather than strictly performing encryption/decryption operations. - Audit Incompleteness: Admin Activity logs capture control-plane changes (such as creating keys) but do not capture cryptographic data usage (which requires Data Access audit logs).
Key Limitations
- Client Management Burden: Passing raw 256-bit encryption keys per request creates massive client overhead and secret-sprawl risk.
- No Organization Policy Enforcement: Lacks declarative constraints to block non-compliant resource creation.
This Answer Would Be Correct If
You were strictly uploading standalone objects to Cloud Storage or encrypting persistent disks where raw customer-supplied key strings must never be persisted in Cloud KMS.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 1,353 practice questions across all 5 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
AdvancedProfessional Data Engineer
Cloud DLP Format-Preserving Encryption and Fixed-Size Bucketing
Legal and regulatory compliance
AdvancedProfessional Data Engineer
Google Cloud Data Residency
Legal and regulatory compliance
AdvancedProfessional Data Engineer
BigQuery Hash Join Data Skew
Troubleshooting poor performing queries
AdvancedProfessional Data Engineer
Datastore Query Cursors and Projection Queries
Troubleshooting poor performing queries
AdvancedProfessional Data Engineer
Cloud Storage Dual-Region Turbo and BigQuery Cross-Region Replication
Regional considerations (data sovereignty) for data access and storage
AdvancedProfessional Cloud Security Engineer
Active/Active Multi-Gateway HA VPN with ECMP
Designing and configuring private connectivity and encryption between data centers and VPC network (e.g., HA VPN, Cloud Interconnect).
Last updated Validated