Your organization operates in a highly regulated industry and needs to implement strict controls around temporary access to sensitive Google Cloud resources. You have been using Access Approval to…

Question

Options

• ACreate a new asymmetric signing key in Cloud Key Management System (Cloud KMS) using a
• BExport your existing Access Approval signing key as a PEM file. Upload the file to your external
• CCreate a signing key in your external HSM. Integrate the HSM with Cloud External Key Manager
• DCreate a new asymmetric signing key in Cloud KMS and configure the key with a rotation period

• A
  4% (1)
• B
  9% (2)
• C
  83% (19)
• D
  4% (1)

Explanation

Cloud External Key Manager (EKM) enables Google Cloud services to use encryption keys that are generated and stored in an external Hardware Security Module (HSM) outside of Google Cloud. This satisfies both compliance requirements: the key resides in an HSM and it is located outside of Google's infrastructure, giving the organization sole custody. Access Approval supports custom signing keys via EKM. Option A creates a key in Cloud KMS using HSM protection, but Cloud HSM still runs within Google Cloud - the key material never leaves Google's environment, violating the external HSM requirement. Option B incorrectly exports the existing key (key export defeats the purpose of HSM custody). Option D creates a Cloud KMS key with rotation, which is still within Google Cloud.

No community discussion yet for this question.