GCP Professional Cloud Security Engineer Practice Question

Your security team is reviewing how telemetry data from thousands of warehouse temperature sensors will be ingested into Cloud Storage and queried from BigQuery. The dataset contains no customer or employee identifiers and is subject only to the company's general data-handling policy, which mandates encryption at rest but does not impose any key custody or key-location requirements. The team wants the simplest, lowest-cost approach that still satisfies the policy. Which encryption option should you recommend?

Require every sensor gateway to include a customer-supplied encryption key (CSEK) with each upload so Cloud Storage encrypts the data using that key on the server side.
Rely on Google-managed default encryption, which automatically encrypts all Cloud Storage objects and BigQuery tables at rest without any extra configuration.
Use Cloud External Key Manager (EKM) so the encryption key is generated and stored in a third-party Hardware Security Module outside Google Cloud.
Configure Customer-Managed Encryption Keys (CMEK) by creating a symmetric key in Cloud KMS and specifying it for the relevant buckets and datasets.

Report Issue

Answer Description

Because the organization has no requirement to control or externally store encryption keys, relying on Google-managed default encryption is the most straightforward and economical solution. Google automatically encrypts all data written to Cloud Storage objects and BigQuery tables at rest using AES-256 keys that it manages and rotates. Configuring Customer-Managed Encryption Keys (CMEK) or Cloud External Key Manager (EKM) would meet the requirement but introduce additional operational overhead and costs for key creation, rotation, and availability. Using customer-supplied encryption keys (CSEK) would likewise add complexity because each read and write request must include the base64-encoded key material and key hash, and Google cannot manage or recover the key if it is lost. Therefore, default Google-managed encryption is the recommended choice.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.