Exam Professional Cloud Security Engineer topic 1 question 136 discussion

Should be BD. A is wrong because there is no comprise happened as the question states "before an incident". As per document "Limiting the number of messages encrypted with the same key version helps prevent attacks enabled by cryptanalysis." https://cloud.google.com/kms/docs/key-rotation

BD is the answer. The steps need to be done BEFORE an incident occurs.

A. Disable and revoke access to compromised keys. B. Enable automatic key version rotation on a regular schedule.

A,B Keys get stolen by attacker then attacker infiltrates the network using those keys. The incident/compromise is when the attacker penetrates and steals data not when the key is stolen. Theft happens when the burglar enters your house and steal stuff not when they make a copy of your house key. If you suspect someone made a copy of your key you go and change the locks and throw away your compromised keys before the incident occurs. So we're in the situation where there are "potentially compromised" keys and need to take action before the attacker uses the keys and hacks the company. We disable access to potentially compromised keys and rotate. https://cloud.google.com/kms/docs/key-rotation "If you suspect that a key version is compromised, disable it and revoke access to it as soon as possible."

You want to reduce the impact - which will be post the issue has occurred so has to be AB. If asked for preventive steps then B &D.

https://cloud.google.com/kms/docs/key-rotation -> "If you suspect that a key version is compromised, disable it and revoke access to it as soon as possible" so A could be correct. do you agree?

B. Enable automatic key version rotation on a regular schedule. D. Limit the number of messages encrypted with each key version.

Answers BD

Should be BD. A is wrong because there is no comprise happened as the question states "before an incident". As per document "Limiting the number of messages encrypted with the same key version helps prevent attacks enabled by cryptanalysis." https://cloud.google.com/kms/docs/key-rotation

should be AB.