Exam Professional Cloud Security Engineer topic 1 question 160 discussion

Actual exam question from Google's Professional Cloud Security Engineer

Question #: 160
Topic #: 1

[All Professional Cloud Security Engineer Questions]

You are working with a client that is concerned about control of their encryption keys for sensitive data. The client does not want to store encryption keys at rest in the same cloud service provider (CSP) as the data that the keys are encrypting. Which Google Cloud encryption solutions should you recommend to this client?
(Choose two.)

A. Customer-supplied encryption keys.
B. Google default encryption
C. Secret Manager
D. Cloud External Key Manager
E. Customer-managed encryption keys

Show Suggested Answer

Suggested Answer: AD 🗳️

by DST at Sept. 28, 2022, 5:22 p.m.

Comments

Submit Cancel

AwesomeGCP

Highly Voted 1 year, 8 months ago

Selected Answer: AD

A. Customer-supplied encryption keys. D. Cloud External Key Manager

upvoted 6 times

...

DST

Highly Voted 1 year, 8 months ago

Selected Answer: AD

CSEK & EKM both store keys outside of GCP

upvoted 6 times

...

gcpengineer

Most Recent 1 year, 1 month ago

what about CMEK?

upvoted 2 times

[Removed]

10 months, 3 weeks ago

in CMEK, even though the keys are managed by customer, they're still using the cloud service Cloud KMS. So it's still in the same Cloud Provider as where the data is which not desired per the question. Reference: https://cloud.google.com/kms/docs/cmek#cmek

upvoted 3 times

...