GCP Professional Cloud Security Engineer Practice Question

Your company is migrating a high-volume payment-processing platform to Google Cloud. Cardholder data will be stored in Cloud Storage and BigQuery, each protected with customer-managed encryption keys (CMEK). PCI DSS auditors insist that encryption keys be generated and stored in FIPS 140-2 Level 3-validated hardware located inside Google Cloud. The application must also sustain thousands of cryptographic operations per second while minimizing latency. Which key-management approach should you adopt?

Switch to customer-supplied encryption keys (CSEK) passed with every object upload and query.
Create symmetric keys in Cloud KMS with the software protection level and configure them as CMEK for the services.
Provision a Cloud HSM key ring, generate symmetric keys in the HSM, and use those keys as CMEK for Cloud Storage and BigQuery.
Configure Cloud External Key Manager (EKM) to reference keys stored in your on-premises hardware security module.

Report Issue

Answer Description

Use Cloud HSM to generate and store the CMEK keys. Cloud HSM keeps keys exclusively in FIPS 140-2 Level 3 validated hardware modules hosted within Google data centers, meeting the auditor's requirement that keys reside in-cloud at the specified assurance level. A Cloud HSM key can be selected as the protection mechanism for Cloud Storage and BigQuery CMEK, and each HSM key version can handle roughly 10,000 cryptographic operations per second-ample capacity for a high-volume payment workload with low latency.

Software-protected Cloud KMS keys are only FIPS 140-2 Level 1, which fails the mandate. Cloud External Key Manager stores keys outside Google Cloud, breaching the in-cloud requirement and adding network latency. Customer-supplied encryption keys (CSEK) require the application to supply the key on every request and are not backed by FIPS 140-2 Level 3 hardware, making them unsuitable here.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.