GCP Professional Data Engineer Practice Question

A healthcare provider must comply with national regulations that prohibit any hyperscaler, including Google Cloud, from ever holding or recovering the encryption keys that protect patient data. The analytics team wants to load sensitive HL7 records into BigQuery and Cloud Storage, using customer-managed encryption keys that reside in an on-premises Hardware Security Module (HSM). The solution must

ensure that Google Cloud services can never decrypt data without a successful call to the on-premises HSM,
avoid operational work to periodically re-import keys into Google Cloud, and
minimize downtime if the primary on-premises HSM becomes unreachable.

Which design best satisfies these requirements?

Create a Cloud KMS key that uses Cloud External Key Manager. Define an EkmConnection with multiple on-premises HSM endpoints and set that key as a CMEK for BigQuery datasets and Cloud Storage buckets.
Configure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS HSM and enable automatic Google-managed fallback in case the on-premises HSM is unavailable.
Use Customer-Supplied Encryption Keys (CSEK) for each Cloud Storage object and configure periodic re-upload of the key material to avoid expiry.
Import the HSM key material into Cloud KMS every 90 days, then reference the imported key as a CMEK for BigQuery and Cloud Storage.

Report Issue

Answer Description

Cloud External Key Manager (EKM) lets Google Cloud wrap the Data Encryption Keys for BigQuery and Cloud Storage with a key that is stored and remains in an external HSM. Because the key material never enters Google-controlled infrastructure, Google can decrypt data only after a real-time unwrap call succeeds against the external key, meeting the "never held by Google" requirement.
To keep the solution highly available without needing to re-import keys, you configure a single Cloud KMS key ring and key version that references an EKM key, and associate that key with an EkmConnection containing multiple redundant endpoints that point to separate HSM instances in your on-premises cluster. Cloud KMS automatically fails over to the next healthy endpoint if the first is unavailable, so encryption and decryption requests continue without operator intervention.
Importing key material into Cloud KMS, using Customer-Supplied Encryption Keys (CSEK), or enabling Google-managed fallback would all violate the requirement that Google must never possess or recover the key, and rotating a new imported key on a schedule would add unnecessary operational overhead.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.