GCP Professional Cloud Architect Practice Question

Customer-managed encryption keys (CMEK) for Cloud Storage satisfy the requirement that the customer controls and rotates the keys that protect data at rest. Creating a Dedicated Interconnect provides the needed 5 Gbps (and higher) bandwidth, while adding HA VPN tunnels over the Interconnect VLAN attachments encrypts every packet in transit without sacrificing throughput or requiring the application to handle encryption itself. The other options fail one or more constraints: relying on Google-managed keys does not give the customer key control; client-side encryption with standalone Cloud VPN over the public internet cannot guarantee 5 Gbps and increases operational burden; Partner or Dedicated Interconnect links without an accompanying VPN leave traffic unencrypted on the physical circuit, violating the in-transit encryption mandate.