GCP Professional Cloud Architect Practice Question

Your organization is launching a multi-tenant analytics SaaS on Google Cloud that ingests and stores telemetry data from customer IoT devices. Raw data lands in Cloud Storage and is transformed into BigQuery tables for reporting. The data is not subject to industry regulations that mandate customer control of cryptographic keys, but customers expect all data at rest to be encrypted. The operations team must minimize day-to-day key lifecycle tasks and avoid introducing any new dependencies that could reduce availability. Which key-management approach should you recommend?

Deploy an on-premises Hardware Security Module and integrate it with Cloud External Key Manager so that encryption keys never reside in Google Cloud.
Create Customer-Managed Encryption Keys (CMEK) in Cloud KMS and schedule automatic rotation every 90 days for all buckets and datasets.
Rely on Google-managed encryption keys, which provide default at-rest encryption for Cloud Storage and BigQuery and are automatically created, stored, and rotated by Google without additional effort.
Require each workload to supply Customer-Supplied Encryption Keys (CSEK) on every write request and rotate the keys monthly.

Report Issue

Answer Description

Google-managed encryption keys are applied automatically to all supported storage services-including Cloud Storage and BigQuery-without any configuration. Google creates, stores, and rotates these keys on a regular schedule, so the operations team has no key-lifecycle work. Because keys reside within Google's highly available infrastructure, there is no extra dependency that could affect uptime. Customer-managed encryption keys, customer-supplied encryption keys, or an on-premises HSM with Cloud EKM would all satisfy encryption-at-rest requirements but add operational overhead (policy management, rotation, key delivery, or external service availability) that the team wants to avoid.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.