PROFESSIONAL-CLOUD-DATABASE-ENGINEER · Question #82
Your organization works with sensitive data that requires you to manage your own encryption keys. You are working on a project that stores that data in a Cloud SQL database. You need to ensure that…
The correct answer is D. Use customer-managed encryption keys with Cloud SQL. Customer-Managed Encryption Keys (CMEK) is the Google Cloud feature that allows you to control the encryption keys used to protect data at rest in Cloud SQL. Keys are stored in Cloud Key Management Service (Cloud KMS) under your control. Exporting data to a CSEK-protected…
Question
Your organization works with sensitive data that requires you to manage your own encryption keys. You are working on a project that stores that data in a Cloud SQL database. You need to ensure that stored data is encrypted with your keys. What should you do?
Options
- AExport data periodically to a Cloud Storage bucket protected by Customer-Supplied Encryption
- BUse Cloud SQL Auth proxy.
- CConnect to Cloud SQL using a connection that has SSL encryption.
- DUse customer-managed encryption keys with Cloud SQL.
How the community answered
(34 responses)- A9% (3)
- B12% (4)
- C3% (1)
- D76% (26)
Explanation
Customer-Managed Encryption Keys (CMEK) is the Google Cloud feature that allows you to control the encryption keys used to protect data at rest in Cloud SQL. Keys are stored in Cloud Key Management Service (Cloud KMS) under your control. Exporting data to a CSEK-protected bucket (A) only encrypts data in Cloud Storage, not within Cloud SQL itself. Cloud SQL Auth Proxy (B) manages secure connections to Cloud SQL but has nothing to do with encryption key management. SSL/TLS connections (C) encrypt data in transit, not data at rest stored in the database.
Topics
Community Discussion
No community discussion yet for this question.