You have a BigQuery table that ingests data directly from a Pub/Sub subscription. The ingested data is encrypted with a Google-managed encryption key. You need to meet a new organization policy that r

Question

Options

• AUse Cloud KMS encryption key with Dataflow to ingest the existing Pub/Sub subscription to the existing BigQuery table.
• BCreate a new BigQuery table by using customer-managed encryption keys (CMEK), and migrate the data from the old BigQuery table.
• CCreate a new Pub/Sub topic with CMEK and use the existing BigQuery table by using Google-managed encryption key.
• DCreate a new BigQuery table and Pub/Sub topic by using customer-managed encryption keys (CMEK), and migrate the data from the old BigQuery table.

• A
  8% (2)
• B
  71% (17)
• C
  4% (1)
• D
  17% (4)

Explanation

Option B is correct because BigQuery tables cannot have their encryption key changed in-place - you must create a new table configured with CMEK (pointing to your centralized Cloud KMS key), then migrate existing data into it. This satisfies the policy requirement that data at rest be encrypted using organization-managed keys.

Why the distractors fail:

• A is wrong because routing data through Dataflow doesn't change the encryption of the existing BigQuery table - the table still uses a Google-managed key, and the problem isn't about the ingestion pipeline.
• C is wrong because encrypting the Pub/Sub topic with CMEK doesn't affect data at rest in BigQuery, and the existing BigQuery table still uses a Google-managed key, violating the policy.
• D is a common trap - creating a new Pub/Sub topic is unnecessary. The Pub/Sub topic doesn't store data at rest in the same persistent way; the policy targets BigQuery storage, so replacing the topic adds cost and complexity with no compliance benefit.

Memory tip: Think "data at rest = where it lives." BigQuery is where the data lives, so that's what needs CMEK. Since you can't re-key an existing BigQuery table, it's always create new + migrate - not patch the pipeline around it.

No community discussion yet for this question.