PROFESSIONAL-CLOUD-DATABASE-ENGINEER · Question #143
HelioBank is deploying Cloud SQL for MySQL in europe-west1 to support payment processing for example.com. The compliance team requires that data at rest be encrypted with a key that they own and manag
The correct answer is C. Create the Cloud SQL for MySQL instance using customer managed encryption keys from Cloud. CMEK (Customer-Managed Encryption Keys) via Cloud KMS satisfies the compliance mandate: the bank owns and manages the key in a specific European KMS location (europe-west1), controls rotation schedules, and can disable or destroy the key to immediately revoke data access. The key
Question
HelioBank is deploying Cloud SQL for MySQL in europe-west1 to support payment processing for example.com. The compliance team requires that data at rest be encrypted with a key that they own and manage in a specific European location, and they must control the key lifecycle including rotation and disablement. They also need all client connections to be encrypted from end to end. What should they configure?
Options
- ACreate the Cloud SQL for MySQL instance with Google managed encryption keys and secure
- BCreate the Cloud SQL for MySQL instance using customer managed encryption keys and place it
- CCreate the Cloud SQL for MySQL instance using customer managed encryption keys from Cloud
- DCreate the Cloud SQL for MySQL instance with Google managed encryption keys and require SSL
How the community answered
(33 responses)- A6% (2)
- B3% (1)
- C76% (25)
- D15% (5)
Explanation
CMEK (Customer-Managed Encryption Keys) via Cloud KMS satisfies the compliance mandate: the bank owns and manages the key in a specific European KMS location (europe-west1), controls rotation schedules, and can disable or destroy the key to immediately revoke data access. The key ring must be in the same region as the Cloud SQL instance. Requiring SSL/TLS enforces encryption in transit for all client connections. Options A and D use Google-managed keys, which do not give the bank ownership or control of the key lifecycle. Option B may place the key in the wrong location, violating the European-residency requirement.
Topics
Community Discussion
No community discussion yet for this question.