GCP Professional Cloud Security Engineer Practice Question

A retail bank headquartered in Frankfurt is migrating customer account statements to Google Cloud. German banking regulations require that every copy of the statements, as well as the encryption keys protecting them, remain physically in Germany. Operations wants to avoid manual key-handling tasks but still control when keys are rotated every quarter. Which Google Cloud design best fulfills the regulatory and operational requirements?

Configure a Cloud Storage custom dual-region bucket across europe-west3 and europe-west1 (Belgium) and protect data with customer-supplied encryption keys that are uploaded during each quarterly rotation.
Store the statements in a Cloud Storage regional bucket in europe-west3 protected by a Cloud KMS CMEK whose key ring is also in europe-west3, and configure automatic key rotation for 90-day intervals.
Create a custom dual-region bucket spanning europe-west3 (Frankfurt) and europe-central2 (Warsaw) and encrypt it with a Cloud KMS CMEK stored in europe-west3.
Use a Cloud Storage multi-region bucket in europe-4 and rely on Google-managed encryption keys to avoid key-rotation tasks.

Report Issue

Answer Description

A regional Cloud Storage bucket located in europe-west3 (Frankfurt) guarantees that all data is stored only in data centers physically located in Germany. Protecting the bucket with a customer-managed encryption key (CMEK) whose key ring is also hosted in europe-west3 keeps the cryptographic material in the same jurisdiction. Cloud KMS allows the bank to set an automatic rotation schedule (for example, every 90 days), eliminating the need to upload or manually re-encrypt data while still giving the customer full control over the key lifecycle.

The other options violate either the data-residency requirement (by storing data or keys outside Germany) or impose unnecessary operational overhead (for example, by requiring manual customer-supplied key management).

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.