Google
PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #8
What are the steps to encrypt data using envelope encryption?
The correct answer is C. Generate a data encryption key (DEK) locally. The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS. https://cloud.google.com/kms/docs/envelope…
Submitted by tom_us· Apr 18, 2026Ensuring data protection
Question
What are the steps to encrypt data using envelope encryption?
Options
- AGenerate a data encryption key (DEK) locally.
- BGenerate a key encryption key (KEK) locally.
- CGenerate a data encryption key (DEK) locally.
- DGenerate a key encryption key (KEK) locally.
How the community answered
(48 responses)- A2% (1)
- B4% (2)
- C90% (43)
- D4% (2)
Explanation
The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS. https://cloud.google.com/kms/docs/envelope- encryption#how_to_encrypt_data_using_envelope_encryption
Topics
#Envelope Encryption#Data Encryption Key (DEK)#Key Management#Data Protection
Community Discussion
No community discussion yet for this question.