Exam Professional Cloud Security Engineer topic 1 question 74 discussion

Actual exam question from Google's Professional Cloud Security Engineer

Question #: 74
Topic #: 1

[All Professional Cloud Security Engineer Questions]

What are the steps to encrypt data using envelope encryption?
A.
✑ Generate a data encryption key (DEK) locally.
✑ Use a key encryption key (KEK) to wrap the DEK.
✑ Encrypt data with the KEK.
✑ Store the encrypted data and the wrapped KEK.
B.
✑ Generate a key encryption key (KEK) locally.
✑ Use the KEK to generate a data encryption key (DEK).
✑ Encrypt data with the DEK.
✑ Store the encrypted data and the wrapped DEK.
C.
✑ Generate a data encryption key (DEK) locally.
✑ Encrypt data with the DEK.
✑ Use a key encryption key (KEK) to wrap the DEK.
✑ Store the encrypted data and the wrapped DEK.
D.
✑ Generate a key encryption key (KEK) locally.
✑ Generate a data encryption key (DEK) locally.
✑ Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.

Show Suggested Answer

Suggested Answer: C
Reference:
https://cloud.google.com/kms/docs/envelope-encryption

by Tabayashi at April 29, 2022, 2:53 a.m.

Comments

Submit Cancel

Tabayashi

Highly Voted 3 years, 1 month ago

Answer is (C). The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS. https://cloud.google.com/kms/docs/envelope-encryption#how_to_encrypt_data_using_envelope_encryption

upvoted 19 times

AzureDP900

2 years, 7 months ago

C is right

upvoted 3 times

...

Mr_MIXER007

Most Recent 9 months, 3 weeks ago

Answer is (C).

upvoted 1 times

...

desertlotus1211

1 year, 9 months ago

Answer is C; https://cloud.google.com/kms/docs/envelope-encryption#:~:text=decrypt%20data%20directly.-,How%20to%20encrypt%20data%20using%20envelope%20encryption,data%20and%20the%20wrapped%20DEK.

upvoted 3 times

...