GCP Professional Data Engineer Practice Question

You are building a Dataflow streaming pipeline that writes to a BigQuery dataset containing sensitive health data. Compliance mandates that data at rest be encrypted with customer-managed keys stored in us-central1, that the key rotate every 90 days without downtime, and that the security team can quickly block the pipeline from decrypting data if a breach is suspected. Which solution best satisfies these requirements?

Rely on Google-managed default encryption for BigQuery and restrict Dataflow workers with VPC Service Controls; accept Google's automatic, silent key rotation.
Create a Cloud KMS key ring in us-central1 and enable automatic key rotation every 90 days. Encrypt the BigQuery dataset with this CMEK and grant the BigQuery service account the CryptoKey Encrypter/Decrypter role; security can revoke this role to stop decryption if needed.
Use client-side encryption by supplying a customer-supplied key (CSEK) to each Dataflow job. Rotate the key by generating a new value and rewriting all existing BigQuery data.
Store an AES-256 key in an on-premises HSM and have Dataflow workers download it through environment variables; rotate by updating the configuration file that contains the key reference.

Report Issue

Answer Description

Cloud KMS-backed customer-managed encryption keys (CMEK) let you control encryption for BigQuery while keeping the key material in a regional key ring such as us-central1. You can configure automatic rotation-for example, every 90 days-which creates a new key version and marks it primary; BigQuery immediately begins using the new version with no disruption to the Dataflow pipeline. To let BigQuery encrypt and decrypt data, grant the BigQuery service account (service-@gcp-sa-bigquery.iam.gserviceaccount.com) the Cloud KMS CryptoKey Encrypter/Decrypter role on the key. If a breach is suspected, security can quickly block decryption by revoking that role from the service account (disabling the key alone would not immediately stop decryption because existing permissions are still cached). Client-side encryption with customer-supplied keys would require manual data rewriting on rotation, Google-managed keys would not meet the customer-managed requirement, and storing keys on-premises would forgo KMS rotation and access-control capabilities.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.