GCP Professional Data Engineer Practice Question

A financial services company ingests transaction files into a Cloud Storage bucket, processes them with Dataflow, and loads the results into a BigQuery dataset-all located in europe-west1. Security policy states:

Google must not manage the encryption keys; the company has to control key rotation and disablement.
Every cryptographic key access must be captured in Cloud Logging and forwarded to the corporate SIEM.
Changing or rotating keys must not require any code changes in the existing Dataflow pipelines.

Which key-management approach best satisfies these requirements?

Create a Cloud KMS key ring in europe-west1 and enable customer-managed encryption keys (CMEK) for the Cloud Storage bucket, the Dataflow job, and the BigQuery dataset; export Cloud Audit Logs to the SIEM.
Configure customer-supplied encryption keys (CSEK) for the Cloud Storage bucket and pass the key in every Dataflow and BigQuery API call, rotating it manually when required.
Rely on Google-managed encryption keys for all services and enable Access Transparency logs to track Google personnel access.
Use Cloud External Key Manager (EKM) with keys stored in an on-premises HSM and attach the external key to Cloud Storage and BigQuery; leave Dataflow on default encryption.

Report Issue

Answer Description

Customer-managed encryption keys (CMEK) stored in Cloud KMS let the customer create, rotate, disable, and destroy the keys that protect data in BigQuery, Cloud Storage, and the Dataflow workers' persistent disks. All encrypt/decrypt operations against a CMEK key are automatically written to Cloud Audit Logs, which can be exported to an external SIEM. Because CMEK is enabled at the resource level (bucket, dataset, Dataflow job) rather than passed in API calls, pipelines continue to run unchanged after key rotation. Customer-supplied encryption keys require applications to transmit the raw key material on every request, so rotating keys demands code or configuration changes and does not generate automatic Cloud KMS audit logs. Google-managed keys violate the requirement that Google not manage the keys, and Cloud External Key Manager is not yet supported by Dataflow, so it cannot cover the entire pipeline.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.