You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in…

Question

Options

• AA firewall rule prevents the key from being accessible.
• BCloud HSM does not support Cloud Storage.
• CThe CMEK is in a different project than the Cloud Storage bucket.
• DThe CMEK is in a different region than the Cloud Storage bucket.

• A
  8% (5)
• B
  3% (2)
• C
  5% (3)
• D
  85% (56)

Explanation

When using a Customer Managed Encryption Key (CMEK) from Cloud KMS with Cloud Storage, the KMS key must reside in the same region as the Cloud Storage bucket. In this scenario, the KMS key is in europe-west3 while the Cloud Storage bucket is in europe-west1 - a region mismatch that prevents the key from being used. The solution is to either move the bucket to europe-west3 or create a new key in europe-west1. Option A is incorrect; there are no firewall rules between KMS and Cloud Storage as they communicate via internal Google APIs. Option B is incorrect; Cloud HSM fully supports Cloud Storage CMEK. Option C is incorrect; KMS keys in a different project (prj-a) can be used to encrypt resources in another project (prj-b) - cross-project CMEK is supported, but cross-region is not.

No community discussion yet for this question.