A company wants to import a key into Cloud KMS for use as a CMEK key. The key was generated on an on-premises HSM and is in PKCS#11 format. The security team needs to ensure the key is protected during the import process and that it can be used immediately after import. What should the security team do?

Store the key in a Cloud Storage bucket and reference it from Cloud KMS.

Create an import job, wrap the key with the import job's public key, and upload the wrapped key.

Use gcloud to upload the raw key file without wrapping.

Convert the key to PEM format and upload it directly to Cloud KMS.

Google CloudProfessional Cloud Security Engineer

Domain 3Objective 2

3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 8)

Part of the Ensuring data protection domain, which accounts for 23% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

36questions here

8free pages

12concepts

23%of the exam

Questions 36–36

36expert · hard
A company wants to import a key into Cloud KMS for use as a CMEK key. The key was generated on an on-premises HSM and is in PKCS#11 format. The security team needs to ensure the key is protected during the import process and that it can be used immediately after import. What should the security team do?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 8)

Questions 36–36

Keep studying — Ensuring data protection