Your organization must store highly sensitive data within Google Cloud. You need to design a solution that provides the strongest level of security and control. What should you do?

Question

Options

• AUse Cloud Storage with customer-supplied encryption keys (CSEK), VPC Service Controls for
• BUse Cloud Storage with customer-managed encryption keys (CMEK), Cloud DLP for data
• CUse Cloud Storage with client-side encryption, Cloud KMS for key management, and Cloud HSM
• DUse Cloud Storage with server-side encryption, BigQuery with column-level encryption, and IAM

• A
  5% (3)
• B
  10% (6)
• C
  65% (41)
• D
  21% (13)

Explanation

Client-side encryption combined with Cloud KMS and Cloud HSM provides the strongest possible security and control. With client-side encryption, data is encrypted before it ever leaves the organization's control and reaches Google's infrastructure - Google never sees plaintext data. Cloud HSM provides hardware-backed key storage that meets FIPS 140-2 Level 3 validation, ensuring keys are generated and stored in tamper-resistant hardware and cannot be exported in plaintext. This gives the organization full sovereignty over their keys and data. CSEK (Option A) has Google temporarily hold a copy of the key for each operation - slightly less control than client-side. CMEK (Option B) stores keys in Cloud KMS but data is decrypted within Google's infrastructure. Server-side encryption (Option D) is Google's default and provides the least customer control. Client-side + Cloud HSM is the strongest combination available.

No community discussion yet for this question.