A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery. What…

The correct answer is C. Customer-managed encryption keys (CMEK). Customer-Managed Encryption Keys (CMEK) lets you create, manage, and control the lifecycle of the encryption keys used to protect your BigQuery data at rest, using Cloud Key Management Service (Cloud KMS). This gives the institution maximum control over key rotation…

Submitted by salim_om· Apr 18, 2026Ensuring data protection

Question

A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery. What technique should the institution use?

Options

AUse Cloud Storage as a federated Data Source.
BUse a Cloud Hardware Security Module (Cloud HSM).
CCustomer-managed encryption keys (CMEK).
DCustomer-supplied encryption keys (CSEK).

How the community answered

(35 responses)

A
3% (1)
B
9% (3)
C
71% (25)
D
17% (6)

Explanation

Customer-Managed Encryption Keys (CMEK) lets you create, manage, and control the lifecycle of the encryption keys used to protect your BigQuery data at rest, using Cloud Key Management Service (Cloud KMS). This gives the institution maximum control over key rotation, revocation, and auditing. Note: BigQuery does not support Customer-Supplied Encryption Keys (CSEK), which is why D is incorrect despite CSEK offering even lower-level control in other services like Cloud Storage. Cloud HSM (B) is a hardware key storage option within Cloud KMS but does not by itself describe an encryption approach. Using Cloud Storage as a federated source (A) has no bearing on encryption control.

Topics

#Encryption#BigQuery#CMEK#Data at rest

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice