Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Question 34 of 107
Free Preview · 107 of 355 · questions 1–107 of 355 are free. Sign up free to sync your progress across devices.
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
B The KEK is always managed by the KMS. The KMS never manages the DEK (so A is wrong). Both C/D are bad options, the customer supplying the encryption key defeats the purpose of the scenario in the question.
To manage encryption for Cloud Dataproc persistent disks, Google Cloud supports Customer-Managed Encryption Keys (CMEK) using Cloud Key Management Service (KMS). In this setup: Data Encryption Key (DEK): Google Cloud automatically generates and manages the DEK for encrypting the persistent disk data. Key Encryption Key (KEK): The KEK, managed in Cloud KMS, encrypts the DEK. This ensures the customer has control over key management operations, such as key rotation and deletion.
Answer is B Cloud KMS allows you to manage KEKs, which in turn are used to encrypt the DEKs. DEKs are then used to encrypt the data. This separation ensures that the more sensitive KEK remains securely managed within the Cloud KMS