You are on the data governance team and are implementing security requirements. You need to encrypt all your data in BigQuery by using an encryption key managed by your team. You must implement a…

Question

Options

• ACreate the encryption key in the on-premises HSM, and import it into a Cloud Key Management Service (Cloud KMS) key. Associate the created Cloud KMS
• BCreate the encryption key in the on-premises HSM and link it to a Cloud External Key Manager (Cloud EKM) key. Associate the created Cloud KMS key while
• CCreate the encryption key in the on-premises HSM, and import it into Cloud Key Management Service (Cloud HSM) key. Associate the created Cloud HSM key
• DCreate the encryption key in the on-premises HSM. Create BigQuery resources and encrypt data while ingesting them into BigQuery.

• A
  4% (1)
• B
  78% (18)
• C
  4% (1)
• D
  13% (3)

Explanation

Option B is correct because Cloud External Key Manager (Cloud EKM) is purpose-built for scenarios where key material must never leave your on-premises HSM - Google's services call out to your external key manager at encrypt/decrypt time rather than ever holding the key material itself. You associate the Cloud EKM-backed Cloud KMS key with your BigQuery dataset as a CMEK (Customer-Managed Encryption Key), satisfying both the Google-managed-solution requirement and the on-premises-only key material requirement.

Option A is wrong because importing a key into Cloud KMS copies the key material into Google's infrastructure, violating the requirement that encryption material exist only on the on-premises HSM.

Option C is wrong for the same reason - importing into Cloud HSM (Google's cloud-based HSM) still moves the key material off-premises and into Google's hardware, breaking the on-premises-only constraint.

Option D is wrong because it bypasses Google managed solutions entirely; manually encrypting data before ingestion doesn't use CMEK or any Google-managed key management service, creating an unmanaged, custom encryption scheme.

Memory tip: Think of the "E" in EKM as External stays External - the key material never crosses into Google's environment, it only gets referenced by a proxy key in Cloud KMS. If you see "import" in an answer, the key has already left your HSM.

No community discussion yet for this question.