GCP Professional Data Engineer Practice Question

A financial-services company must store sensitive PII in BigQuery while retaining full control over the encryption keys. Compliance rules state that keys must reside in the europe-west2 region, rotate every 90 days, and be usable only by BigQuery; analytics engineers may query the data but must not have direct access to decrypt it. The company also wants to avoid passing an encryption key reference in every query job. Which design best meets these requirements with the least operational overhead?

Create datasets in europe-west2 and set a dataset-level default CMEK from a europe-west2 keyring; grant the project's BigQuery service agent the CryptoKey Encrypter/Decrypter role and configure a 90-day automatic rotation schedule on the key.
Enable default Google-managed encryption and restrict PII access with BigQuery IAM roles; no customer keys are required.
Adopt customer-supplied encryption keys (CSEK) so that engineers supply the key in every BigQuery job request, ensuring the key never resides in Google Cloud.
Stage data in a CMEK-protected Cloud Storage bucket and query it through BigQuery external tables, relying on inherited bucket permissions instead of granting the BigQuery service agent access to the key.

Report Issue

Answer Description

Configuring a default customer-managed encryption key (CMEK) on the BigQuery dataset meets all listed requirements. The KMS key and the dataset must share the same region, so a europe-west2 keyring is appropriate. Granting the BigQuery service agent the Cloud KMS CryptoKey Encrypter/Decrypter role lets BigQuery use the key while preventing users from accessing it directly. Cloud KMS can be set to rotate the key automatically every 90 days, and once the dataset default key is set, BigQuery applies it without requiring the client to include the key on each job. The other options fail: default Google-managed encryption does not satisfy the control requirement; customer-supplied keys demand the key with every request and expose it to users; and external tables in Cloud Storage would still need the service agent's KMS permissions and add unnecessary complexity.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.