GCP Professional Cloud Security Engineer Practice Question

A healthcare provider is migrating a 10-year document archive from an on-premises NAS to Cloud Storage. Internal policy requires the following:

If regulators mandate immediate disposal, the data must become unreadable within 24 hours.
Encryption keys must reside in Google Cloud to avoid having to operate or audit on-premises HSMs.
Google must be unable to decrypt the data using its own keys. Which encryption strategy best satisfies these requirements?

Adopt Cloud External Key Manager so the bucket is protected with a key stored in an on-premises HSM, then revoke access to that key if disposal is mandated.
Rely on Google-managed default encryption and configure an object lifecycle delete rule to remove data upon regulatory request.
Perform client-side encryption using customer-supplied encryption keys (CSEK), store the keys off-platform, and discard them when disposal is needed.
Enable a symmetric customer-managed encryption key in Cloud KMS for the bucket and invoke key-version destruction when disposal is required.

Report Issue

Answer Description

Using a symmetric customer-managed encryption key (CMEK) stored in Cloud KMS fulfills all constraints. The key material resides entirely within Google Cloud, so there is no need for an on-premises HSM. If regulators require disposal, you can call projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.destroy to schedule the key version for destruction; the key is disabled immediately and irreversibly destroyed after the mandatory 24-hour waiting period, rendering the encrypted data unrecoverable within the required timeframe. Because Cloud Storage relies solely on the customer-managed key, Google's default keys cannot decrypt the objects. External Key Manager violates the in-cloud key requirement, customer-supplied keys add external operational overhead, and default encryption gives customers no control over crypto-shredding.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.