Your company uses Cloud KMS to manage encryption keys for BigQuery tables. A compliance audit requires that keys be rotated every 90 days. You want to automate this process without manual intervention. What should you do?

Create a new key version every 90 days and update the BigQuery table to use it.

Manually rotate the key every 90 days using the Cloud Console.

Configure automatic rotation on the Cloud KMS key with a rotation period of 90 days.

Use a Cloud Function to rotate the key every 90 days.

A multinational company must transfer data between two Google Cloud regions. The data is subject to a regulation that requires encryption in transit. The company also wants to minimize the cost of the transfer. Which approach should they use?

Use Google's internal network, which is encrypted by default.

Use the public internet with TLS.

Use a VPN tunnel between the two regions.

Your team is designing a data pipeline that writes sensitive data to BigQuery. You need to ensure that the data is encrypted at rest using a key that your team manages, and you want to centralize key management to avoid duplicating keys across projects. What should you do?

Create a Cloud KMS key ring in one project and use the same key for BigQuery in all projects.

Use Google-managed keys and rely on Google to manage them centrally.

Use CSEK and store the keys in a Cloud Storage bucket.

Create a separate Cloud KMS key in each project that uses BigQuery.

Which Google Cloud mechanism is used to encrypt data at rest by default for services like Cloud Storage and Compute Engine?

Customer-supplied encryption keys (CSEK)

Google-managed encryption keys (GMEK)

A government agency needs to store classified data in Cloud Storage. The data must be encrypted at rest with keys that are generated and stored on-premises. The agency also needs to ensure that Google cannot access the keys. Which solution should they implement?

Use GMEK and rely on Google's security controls.

Use Cloud EKM with an on-premises key management system.

Use CMEK with Cloud KMS and store the keys in a key ring in the same project.

Use CSEK and provide the keys to Cloud Storage for each upload.

Google CloudAssociate Data Practitioner

Domain 4Objective 4

4.2 Apply Security Measures and Ensure Compliance with Data Privacy Regulations ASSOCIATE-DATA-PRACTITIONER Practice Questions (Page 3)

Part of the Data Management domain, which accounts for ~25% of the ASSOCIATE-DATA-PRACTITIONER exam.

16questions here

4free pages

3concepts

~25%of the exam

Questions 11–15

11application · easy
Your company uses Cloud KMS to manage encryption keys for BigQuery tables. A compliance audit requires that keys be rotated every 90 days. You want to automate this process without manual intervention. What should you do?
Select an answer first
12expert · hard
A multinational company must transfer data between two Google Cloud regions. The data is subject to a regulation that requires encryption in transit. The company also wants to minimize the cost of the transfer. Which approach should they use?
Select an answer first
13application · medium
Your team is designing a data pipeline that writes sensitive data to BigQuery. You need to ensure that the data is encrypted at rest using a key that your team manages, and you want to centralize key management to avoid duplicating keys across projects. What should you do?
Select an answer first
14foundation · easy
Which Google Cloud mechanism is used to encrypt data at rest by default for services like Cloud Storage and Compute Engine?
Select an answer first
15expert · hard
A government agency needs to store classified data in Cloud Storage. The data must be encrypted at rest with keys that are generated and stored on-premises. The agency also needs to ensure that Google cannot access the keys. Which solution should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ASSOCIATE-DATA-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “ASSOCIATE-DATA-PRACTITIONER” is a trademark of its owner, used for identification only.