3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A company stores sensitive customer data in Cloud Storage and must be able to revoke access by deleting encryption keys. Which encryption method should they apply to the Cloud Storage bucket?

   • ANo encryption
   • BGoogle default encryption
   • CCloud EKM
   • DCMEK
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A startup is storing non-sensitive marketing brochures in Cloud Storage and serving them to the public via a website. They have no regulatory requirements for key control. Which statement about Google's default encryption is correct?

   • ADefault encryption is not applied to publicly accessible objects, so the startup must enable CMEK.
   • BDefault encryption at rest and in transit is sufficient for this use case, as no additional key control is required.
   • CDefault encryption only protects data in transit, not at rest, so the startup must configure encryption at rest.
   • DDefault encryption requires the startup to manage their own keys to ensure data is protected.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is designing a data-encryption strategy for two workloads. Workload A stores non-sensitive marketing data and has no compliance requirements. Workload B stores payment card data and is subject to a standard that requires keys to be protected by a FIPS 140-2 Level 3 certified HSM. The company wants to minimize cost and operational overhead. What should the security team recommend?

   • AUse Google default encryption for Workload A and Cloud EKM with a partner HSM for Workload B.
   • BUse CMEK with Cloud HSM for Workload A and default encryption for Workload B.
   • CUse Cloud EKM for Workload A and Google default encryption for Workload B.
   • DUse CMEK with software keys for both Workload A and Workload B.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A customer wants to use encryption keys that are software-based and managed in Cloud KMS. Which encryption option should they choose?

   • AGoogle default encryption
   • BCloud HSM
   • CCustomer-managed encryption keys (CMEK)
   • DCloud EKM
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to use CMEK for a new application but has a corporate requirement to use keys generated by its own key-management system. The company has exported the key in a standard format and wants to import it into Cloud KMS. What must the security team do to ensure the key can be imported securely?

   • AUpload the raw key file directly to Cloud KMS using the Cloud Console.
   • BStore the key in a Cloud Storage bucket and reference it from Cloud KMS.
   • CConvert the key to PEM format and paste it into the Cloud KMS key-creation form.
   • DGenerate an import job in Cloud KMS, wrap the key with the provided public key, and upload the wrapped key.
   Reveal Solution Discussion Select an answer first