4.2 Apply Security Measures and Ensure Compliance with Data Privacy Regulations ASSOCIATE-DATA-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   Your organization uses Cloud KMS to encrypt data in BigQuery. A new compliance policy requires that encryption keys be rotated every 30 days, but your security team is concerned that automatic rotation may cause downtime for applications that use the keys. What should you do to meet the rotation requirement while minimizing disruption?

   • AManually rotate the key every 30 days and update all applications to use the new key.
   • BEnable automatic rotation with a 30-day rotation period and rely on Cloud KMS to manage key versions.
   • CDisable automatic rotation and create a new key every 30 days, then re-encrypt all data.
   • DUse a Cloud Function to rotate the key and restart all BigQuery jobs.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is required by its data privacy policy to be able to delete encryption keys to ensure that data is unrecoverable. They use Cloud Storage and want to ensure that when they delete a key, the data encrypted with it becomes inaccessible. Which key management approach should they use?

   • AUse CSEK and delete the keys from your own system.
   • BUse Cloud EKM and delete the keys from the external key management system.
   • CUse CMEK with Cloud KMS and delete the key when needed.
   • DUse GMEK and request Google to delete the keys.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A data practitioner is moving data from an on-premises database to Cloud Storage. During the transfer, the data is protected by TLS. This is an example of which type of encryption?

   • AClient-side encryption
   • BApplication-layer encryption
   • CEncryption in transit
   • DEncryption at rest
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A data practitioner needs to encrypt data in Cloud Storage with a key that they generate and manage themselves, and they want to provide the key material with each API call. Which encryption key management model should they use?

   • ACustomer-supplied encryption keys (CSEK)
   • BCloud External Key Manager (Cloud EKM)
   • CGoogle-managed encryption keys (GMEK)
   • DCustomer-managed encryption keys (CMEK)
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your organization is migrating to Google Cloud and must comply with a policy that requires encryption keys to be stored on-premises and never leave your data center. You need to use Google Cloud services for data processing. Which option should you choose?

   • AUse Cloud External Key Manager (Cloud EKM) with a key management system hosted on-premises.
   • BUse CSEK and provide keys to Google Cloud for each operation.
   • CUse Google-managed keys and rely on Google's security controls.
   • DUse CMEK with Cloud KMS and store the keys in a Cloud KMS key ring.
   Reveal Solution Discussion Select an answer first