Google
PROFESSIONAL-DATA-ENGINEER · Question #165
You want to archive data in Cloud Storage. Because some data is very sensitive, you want to use the "Trust No One" (TNO) approach to encrypt your data to prevent the cloud provider staff from…
The correct answer is A. Use gcloud kms keys create to create a symmetric key. Then use gcloud kms encrypt to encrypt each archival file with the key and unique additional. Explanation/Reference: As the question says Trust No One, this is the only approach where the additional authenticated data (AAD) is not available in GCP without which the files can not
Submitted by wei.xz· Mar 30, 2026Ensuring solution quality
Question
You want to archive data in Cloud Storage. Because some data is very sensitive, you want to use the "Trust No One" (TNO) approach to encrypt your data to prevent the cloud provider staff from decrypting your data. What should you do?
Options
- AUse gcloud kms keys create to create a symmetric key. Then use gcloud kms encrypt to encrypt each archival file with the key and unique additional
- BUse gcloud kms keys create to create a symmetric key. Then use gcloud kms encrypt to encrypt each archival file with the key. Use gsutil cp to upload each
- CSpecify customer-supplied encryption key (CSEK) in the .boto configuration file. Use gsutil cp to upload each archival file to the Cloud Storage bucket. Save the
- DSpecify customer-supplied encryption key (CSEK) in the .boto configuration file. Use gsutil cp to upload each archival file to the Cloud Storage bucket. Save the
How the community answered
(36 responses)- A64% (23)
- B19% (7)
- C11% (4)
- D6% (2)
Explanation
Explanation/Reference: As the question says Trust No One, this is the only approach where the additional authenticated data (AAD) is not available in GCP without which the files can not
Topics
#CSEK#Trust No One encryption#Cloud Storage security#customer-supplied keys
Community Discussion
No community discussion yet for this question.