GCP Professional Cloud Security Engineer Practice Question

Your organization stores raw data in a Cloud Storage bucket in europe-west3 and ingests it into a BigQuery dataset in the EU multi-region. Audit logs will be archived daily and signed with an asymmetric key. Policy requires that CMEK keys reside in the same Google Cloud location as the data whenever possible, with the fewest key rings. Which design meets these constraints?

Create two key rings: one in eu with a symmetric key for BigQuery, and one in europe-west3 with a symmetric key for Cloud Storage. Add an asymmetric RSA-2048 signing key in either ring.
Create three key rings: europe-west3, eu, and global. Place a symmetric key for each workload in its own ring and the signing key in the global ring.
Create one key ring in the eu multi-region containing two symmetric encryption keys for Cloud Storage and BigQuery, plus an asymmetric RSA signing key.
Create one key ring in europe-west3 containing a single symmetric encryption key shared by Cloud Storage and BigQuery, plus an asymmetric signing key.

Report Issue

Answer Description

Although Cloud Storage can consume a CMEK key from any Cloud KMS location, the internal policy requires using a key in the same region when that option exists, so the bucket's key is placed in europe-west3. BigQuery enforces that a dataset in the EU multi-region can only be protected by a key that also resides in the EU multi-region, so a second key ring there is compulsory. Because key rings are location-scoped, two key rings-eu and europe-west3-satisfy both Google Cloud's service constraints and the policy while minimizing operational overhead. The asymmetric RSA signing key is not tied to any service-managed data location, so hosting it in either of the existing rings complies with the policy without creating an additional ring. A single key ring would break either the BigQuery restriction or the organizational policy, while three key rings introduce unnecessary management effort.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.