🔥 40% Off Crucial Exams Memberships — Deal ends today!

10 minutes, 46 seconds remaining!
Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your organization must retain sole custody of its encryption keys on an on-premises HSM. You decide to use Cloud External Key Manager (EKM) so that both BigQuery datasets and Compute Engine persistent disks are protected by keys stored outside Google Cloud. Which statement accurately describes how Google Cloud interacts with those externally hosted keys during normal read and write operations?

  • Because EKM is enabled, Google Cloud support cannot rotate or create snapshots of encrypted persistent disks until the keys are re-imported.

  • EKM can be configured only with asymmetric keys; symmetric keys are not supported.

  • The customer-owned key-encrypting key never leaves the external system; Cloud KMS contacts that system over the network to wrap or unwrap the data encryption key each time data is accessed.

  • BigQuery tables and disks protected by EKM must reside in a dedicated project that contains no other Google Cloud resources.

GCP Professional Cloud Security Engineer
Ensuring data protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot