You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key…

Question

Options

• AEncrypt non-sensitive data and sensitive data with Cloud External Key Manager.
• BEncrypt non-sensitive data and sensitive data with Cloud Key Management Service
• CEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud
• DEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud

• A
  10% (3)
• B
  6% (2)
• C
  26% (8)
• D
  58% (18)

Explanation

The truncated answer D describes the optimal split strategy: use Google default encryption for non-sensitive data (simplest key management, zero operational overhead, and FIPS 140-2 L1 compliant), and use Cloud Key Management Service (CMEK) for sensitive data (gives control over key residency, rotation schedule, and access, also FIPS 140-2 L1 compliant). Option A (Cloud External Key Manager for all data) adds unnecessary complexity and latency for non-sensitive data and uses keys stored outside GCP entirely. Option B (Cloud KMS for all data) increases management complexity even for non-sensitive data without added benefit. Option C describes a similar split but likely pairs with Cloud External Key Manager for sensitive data, which exceeds the requirement and adds unnecessary complexity.

No community discussion yet for this question.