Your organization has a security policy to ensure that all Cloud SQL for PostgreSQL databases are secure. You want to protect sensitive data by using a key that meets specific locality or residency…

Question

Options

• ACreate the database with Google-managed encryption keys.
• BCreate the database with customer-managed encryption keys.
• CCreate the database persistent disk with Google-managed encryption keys.
• DCreate the database persistent disk with customer-managed encryption keys.

• A
  15% (6)
• B
  78% (31)
• C
  3% (1)
• D
  5% (2)

Explanation

Customer-Managed Encryption Keys (CMEK) allow an organization to use keys stored in Cloud KMS (or an external KMS) to encrypt Cloud SQL data at rest, while retaining full control over the key's lifecycle-including creation, rotation, disabling, and deletion. This directly satisfies the locality/residency requirement (keys can be restricted to specific regions in Cloud KMS) and the lifecycle control requirement. Option A (Google-managed keys) offloads lifecycle control to Google, violating the stated requirement. Options C and D refer to encrypting the persistent disk directly, which is a lower-level control not specific to Cloud SQL's encryption configuration and does not provide the same CMEK integration and management capabilities.

No community discussion yet for this question.