Exam Professional Cloud Security Engineer topic 1 question 100 discussion

Both B and D seem correct tbh. D might be "more correct" depending on the interpretation. "reduces key management complexity for non-sensitive data" - Google default encryption "protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule" - Customer Managed Key

D is the answer.

https://cloud.google.com/kms/docs/key-management-service#choose For example, you might use software keys for your least sensitive data and hardware or external keys for your most sensitive data. FIPS 140-2 Level 1 validated applies to both Google default encryption and Cloud Key Management Service (KMS)

D. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service (KMS)

corrcet Answer is D, both KMS and default encryption are FIPS 140-2 L1 compliance https://cloud.google.com/kms/docs/key-management-service#choose

"D" Default encryption is Fips 140-2 L2 compliant (reference A below). Cloud KMS provides the rotation convenience desired (reference B below). References: A- https://cloud.google.com/docs/security/encryption/default-encryption B- https://cloud.google.com/docs/security/key-management-deep-dive

"reduces key management" & "FIPS 140-2 L1 compliance is required for all data types" - strongly suggests answer B

As FIPS 140-2 L1 compliance is required for all types of data, Cloud KMS should be used to manage encryption. Correct answer is B https://cloud.google.com/docs/security/key-management-deep-dive#software-protection-level:~:text=The%20Cloud%20KMS%20binary%20is%20built%20against%20FIPS%20140%2D2%20Level%201%E2%80%93validated%20Cryptographic%20Primitives%20of%20this%20module

Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, BoringCrypto, to implement encryption consistently across almost all Google Cloud products. To provideflexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service

base on "FIPS 140-2 L1 compliance is required for all data types"

KMS is ok for fips 140-2 level 1 https://cloud.google.com/docs/security/key-management-deep-dive#platform-overview

In my opinion, the answer is B. The question says that it is necessary to control "key residency and rotation schedule" for both types of data. Default encryption at rest does not provide that but Cloud KMS does. Furthermore, Cloud KMS is FIPS140-2 level 1. https://cloud.google.com/docs/security/key-management-deep-dive

D is the wander

Answer = D