PROFESSIONAL-CLOUD-ARCHITECT · Question #364
You are deploying a highly confidential data processing workload on Google Cloud. Your company's compliance framework mandates that cryptographic keys used for encrypting data at rest must be…
The correct answer is C. Create a new key in Cloud Key Management Service (Cloud KMS) with the HSM protection level. Creating a Cloud KMS key with the HSM protection level ensures that cryptographic keys are generated, stored, and used exclusively within Google-managed, FIPS 140-2 validated hardware security modules. This fully integrated managed service meets strict compliance requirements…
Question
Options
- AUse Customer-Supplied Encryption Keys (CSEK) by providing your on-premises generated key
- BImport your on-premises HSM key material into a Cloud KMS key with the SOFTWARE protection
- CCreate a new key in Cloud Key Management Service (Cloud KMS) with the HSM protection level.
- DConfigure Cloud External Key Manager (Cloud EKM) to connect to your on-premises HSM.
How the community answered
(24 responses)- A13% (3)
- B8% (2)
- C75% (18)
- D4% (1)
Explanation
Creating a Cloud KMS key with the HSM protection level ensures that cryptographic keys are generated, stored, and used exclusively within Google-managed, FIPS 140-2 validated hardware security modules. This fully integrated managed service meets strict compliance requirements while minimizing operational overhead for key lifecycle management.
Topics
Community Discussion
No community discussion yet for this question.