You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate…

Question

Options

• ACustomer-managed encryption keys
• BCustomer-Supplied Encryption Keys
• CKey Access Justifications
• DAccess Transparency and Approval
• ECloud External Key Manager

• A
  6% (3)
• B
  10% (5)
• C
  61% (30)
• D
  22% (11)

Explanation

The three requirements map directly to two services: (1) 'Separate key management provider from data management' requires Cloud External Key Manager (EKM) (E), which integrates with a third-party key management service (e.g., Thales, Fortanix) so encryption keys are stored and managed outside of Google's infrastructure - BigQuery, Cloud SQL, and Cloud Storage can all use EKM-backed CMEK. (2) 'Visibility into all encryption key requests' requires Key Access Justifications (KAJ) (C), which works with Cloud EKM to provide a justification (reason code) for every cryptographic key access request, and allows you to approve or deny requests programmatically. (3) 'Full lifecycle management' is handled by EKM in conjunction with your external KMS. Customer-Managed Encryption Keys (A) keep keys in Cloud KMS (Google-managed infrastructure), not a separate provider. Customer-Supplied Encryption Keys (B) are per-request keys with no lifecycle management. Access Transparency and Approval (D) covers Google admin access visibility, not encryption key request visibility.

No community discussion yet for this question.