nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #171

Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still…

The correct answer is C. Use customer-managed encryption keys to delete specific encryption keys. https://cloud.google.com/sql/docs/mysql/cmek "You might have situations where you want to permanently destroy data encrypted with CMEK. To do this, you destroy the customer-managed encryption key version. You can't destroy the keyring or key, but you can destroy key versions of…

Submitted by alyssa_d· Apr 18, 2026Ensuring data protection

Question

Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead. What should you do?

Options

  • AUse client-side encryption before sending data to Google Cloud, and delete encryption keys on-
  • BUse Cloud External Key Manager to delete specific encryption keys.
  • CUse customer-managed encryption keys to delete specific encryption keys.
  • DUse Google default encryption to delete specific encryption keys.

How the community answered

(38 responses)
  • A
    5% (2)
  • B
    13% (5)
  • C
    74% (28)
  • D
    8% (3)

Explanation

https://cloud.google.com/sql/docs/mysql/cmek "You might have situations where you want to permanently destroy data encrypted with CMEK. To do this, you destroy the customer-managed encryption key version. You can't destroy the keyring or key, but you can destroy key versions of the key."

Topics

#Crypto-shredding#Customer-Managed Encryption Keys (CMEK)#Data Protection#Key Management Service (KMS)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice