You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive data. Your solution has the following requirements…

Question

Options

• AEncrypt non-sensitive data and sensitive data with Cloud External Key Manager.
• BEncrypt non-sensitive data and sensitive data with Cloud Key Management Service.
• CEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud
• DEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud

• A
  3% (1)
• B
  9% (3)
• C
  3% (1)
• D
  85% (29)

Explanation

The correct answer is D: use Google default encryption for non-sensitive data and Cloud KMS (Customer-Managed Encryption Keys, CMEK) for sensitive data. Google default encryption requires zero key management overhead, directly satisfying the 'reduces key management complexity for non-sensitive data' requirement. Cloud KMS satisfies all three sensitive-data requirements: it supports scheduled automatic key rotation, allows you to specify the region where keys are stored (meeting data residency/control requirements), and because keys are hosted within Google's infrastructure, access latency is minimal - far lower than Cloud External Key Manager (A/B), which routes key requests to an external system outside Google's network. Options A and B both apply the same solution to non-sensitive data, unnecessarily adding management complexity.

No community discussion yet for this question.