GCP Professional Cloud Architect Practice Question

A government agency is migrating tens of terabytes of scanned legal records to Compute Engine persistent disks. Compliance policy states:

Google Cloud must never retain any copy-encrypted or plaintext-of the encryption key.
Security officers must be able to make the data permanently unreadable at any moment by deleting their local key material, without invoking any additional Google Cloud APIs.

Which data-at-rest encryption approach best satisfies these requirements?

Use CMEK with Cloud External Key Manager backed by an on-premises HSM.
Use customer-managed encryption keys (CMEK) stored in Cloud KMS and rotate them manually on demand.
Rely on Google-managed default encryption for persistent disks, which encrypts data without any customer-side keys.
Use customer-supplied encryption keys (CSEK) and provide the key in every Compute Engine API request that touches the disks.

Report Issue

Answer Description

Customer-supplied encryption keys (CSEK) meet both constraints. With CSEK, the customer generates and stores the key entirely outside Google Cloud and attaches it to each API request that creates or accesses encrypted data. Google never persists the key; it exists only in memory for the duration of the request. If the customer later destroys the local copy of the key, Google can no longer decrypt the persistent disks, immediately rendering the data unrecoverable without any further action in Cloud.

Alternatives do not satisfy the policy:

Customer-managed encryption keys (CMEK) stored in Cloud KMS leave the key material under Google's management.
CMEK with Cloud External Key Manager still requires Google Cloud services to fetch the key from an external system each time data is accessed, so merely deleting a local copy would not disable access.
Google-managed default encryption keys are fully controlled by Google and provide no customer control over key destruction.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.