You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days…

Question

Options

• AAnalyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active
• BAssess the keys in the Cloud Key Management Service by implementing code in Cloud Run. If a
• CDefine a metric that checks for timely key updates by using Cloud Logging. If a key is not rotated
• DIdentify keys that have not been rotated by using Security Health Analytics. If a key is not rotated

• A
  2% (1)
• B
  11% (6)
• C
  5% (3)
• D
  82% (47)

Explanation

Security Health Analytics (SHA), a built-in service within Security Command Center (SCC), includes a native detector called KMS_KEY_NOT_ROTATED that automatically identifies Cloud KMS encryption keys that have not been rotated within the required period (default 90 days). This is the most effective detection strategy because it requires no custom code, no manual data analysis, and produces actionable findings directly in SCC. Option A requires manual analysis of Cloud Asset Inventory data. Option B requires writing and maintaining custom code in Cloud Run. Option C requires manually defining a custom log-based metric, which is more complex and indirect. SHA provides the most automated and purpose-built detection capability for this exact compliance requirement.

No community discussion yet for this question.