Google
PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #63
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer. What should you do?
The correct answer is A. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key. The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS.
Submitted by rachelw· Apr 18, 2026Ensuring data protection
Question
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer. What should you do?
Options
- AGenerate a data encryption key (DEK) locally to encrypt the data, and generate a new key
- BGenerate a data encryption key (DEK) locally to encrypt the data, and generate a new key
- CGenerate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key
- DGenerate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key
How the community answered
(29 responses)- A76% (22)
- B7% (2)
- C14% (4)
- D3% (1)
Explanation
The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS.
Topics
#Envelope Encryption#Cloud KMS#Application Layer Encryption#Data Encryption Key
Community Discussion
No community discussion yet for this question.