You want data on Compute Engine disks to be encrypted at rest with keys managed by Cloud Key Management Service (KMS). Cloud Identity and Access Management (IAM) permissions to these keys must be…

Question

Options

• ACreate a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM
• BCreate a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM
• CCreate a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the
• DCreate a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the

• A
  14% (6)
• B
  79% (33)
• C
  5% (2)
• D
  2% (1)

Explanation

In Cloud KMS, IAM permissions are set at the KeyRing level and inherited by all Keys within that KeyRing. If the requirement is to manage permissions in a grouped way with the same permissions for all keys, placing all Keys in a single KeyRing and managing IAM at that KeyRing level is the correct approach. Option A is incorrect because it likely suggests managing IAM at the individual Key level, which creates per-key overhead. Options C and D (KeyRing per disk) would fragment IAM management across many KeyRings, making it impossible to group permissions uniformly. Option B - a single KeyRing, all Keys inside it, IAM managed at the KeyRing - satisfies the grouped management requirement.

No community discussion yet for this question.