Your application stores customers' content in a Cloud Storage bucket, with each object being encrypted with the customer's encryption key. The key for each object in Cloud Storage is entered into your

Question

Options

• AYou attempted the read operation on the object with the customer's base64-encoded key.
• BYou attempted the read operation without the base64-encoded SHA256 hash of the encryption
• CYou entered the same encryption algorithm specified by the customer when attempting the read
• DYou attempted the read operation on the object with the base64-encoded SHA256 hash of the

• A
  3% (1)
• B
  82% (31)
• C
  5% (2)
• D
  11% (4)

Explanation

Cloud Storage Customer-Supplied Encryption Keys (CSEK) require three HTTP headers on every read or write request: x-goog-encryption-algorithm (e.g., AES256), x-goog-encryption-key (the base64-encoded 256-bit key), and x-goog-encryption-key-sha256 (the base64-encoded SHA256 hash of the key). The hash is used by Google to verify the key was not corrupted in transit. If the SHA256 hash header is omitted, Cloud Storage returns a 400 Bad Request error because the request is malformed. Option A is incorrect - providing the base64-encoded key is required and correct, not a cause of error. Option C is incorrect - specifying the same algorithm the customer used is the right thing to do. Option D is a distractor that describes supplying the SHA256 hash, which is actually the correct and required behavior, not an error condition.

No community discussion yet for this question.