A cloud customer has an on-premises key management system and wants to generate, protect, rotate, and audit encryption keys with it. How can the customer use Cloud Storage with their own encryption…

Question

Options

• ADeclare usage of default encryption at rest in the audit report on compliance
• BUpload encryption keys to the same Cloud Storage bucket
• CUse Customer Managed Encryption Keys (CMEK)
• DUse Customer-Supplied Encryption Keys (CSEK)

• A
  6% (2)
• B
  16% (5)
• C
  3% (1)
• D
  75% (24)

Explanation

Customer-Supplied Encryption Keys (CSEK) allow the customer to generate and manage their encryption keys entirely on their own on-premises key management system and supply those keys directly to Google Cloud Storage for each operation. Google never stores the keys permanently - they are used transiently and discarded. This matches the requirement of using an existing on-premises KMS. Option C (CMEK - Customer Managed Encryption Keys) is incorrect because CMEK stores keys in Google's Cloud KMS, not in the customer's own on-premises system. Option A (default encryption at rest) means Google manages the keys entirely. Option B (uploading keys to the same bucket) is a serious security anti-pattern - storing keys alongside the encrypted data provides no protection.

No community discussion yet for this question.