Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise DevOps team is architecting a continuous integration and continuous deployment (CI/CD) pipeline on Google Cloud. The architecture spans a dedicated security project for key management (proj-kms-sec) and a pipeline project (proj-cicd-prod).
The pipeline requires Customer-Managed Encryption Keys (CMEK) to protect the following components:
StudyCerts
StudyCertsus-central1 and us-east1us-central1us-central1How should you configure the Cloud KMS keys and IAM permissions to support envelope encryption across these CI/CD pipeline resources?
Create regional symmetric KMS keys in us-central1 and us-east1 within proj-cicd-prod. Grant the roles/cloudkms.admin role on the key rings to the CI/CD pipeline service account.
Create regional symmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the us-central1 key to the Cloud Storage and Artifact Registry service agents, and grant the role on both regional keys to the Secret Manager service identity.
Create regional asymmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.signerVerifier role to the Secret Manager, Cloud Storage, and Artifact Registry service agents.
Create a single global symmetric KMS key in proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on this global key to the Cloud Build service account used by the CI/CD pipeline.
Create regional symmetric KMS keys in us-central1 and us-east1 within proj-cicd-prod. Grant the roles/cloudkms.admin role on the key rings to the CI/CD pipeline service account.
Create regional symmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the us-central1 key to the Cloud Storage and Artifact Registry service agents, and grant the role on both regional keys to the Secret Manager service identity.
Customer-Managed Encryption Keys (CMEK) allow organizations to use Cloud Key Management Service (Cloud KMS) to control the Key Encryption Keys (KEKs) that protect data at rest. Under Google Cloud's envelope encryption model, services generate a local, unique Data Encryption Key (DEK) to encrypt the actual resource payload (such as a secret version, storage object, or container layer), and the DEK is subsequently encrypted using the KEK residing in Cloud KMS.
us-central1 and us-east1 satisfies the location constraints for all target services.us-central1 and us-east1, separate CMEK keys matching each replica region must be provisioned. The Secret Manager service identity (service-@gcp-sa-secretmanager.iam.gserviceaccount.com) must have roles/cloudkms.cryptoKeyEncrypterDecrypter on both regional keys to encrypt and decrypt the DEKs for secret versions in those regions.service-@gs-project-accounts.iam.gserviceaccount.com) and the Artifact Registry service agent (service-@gcp-sa-artifactregistry.iam.gserviceaccount.com) must be granted roles/cloudkms.cryptoKeyEncrypterDecrypter on the us-central1 KMS key.proj-kms-sec) isolates key lifecycle management from application workloads.Create regional asymmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.signerVerifier role to the Secret Manager, Cloud Storage, and Artifact Registry service agents.
Create a single global symmetric KMS key in proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on this global key to the Cloud Build service account used by the CI/CD pipeline.