Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Google Cloud Certified Professional Data Engineer · Google Cloud
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
D is incorrect because referencing keys in API service calls doesn't meet the requirements for encrypting data at rest. This approach is more related to accessing data at runtime, not storing it securely.
CMEK is where customer managers keys, but are still created by Google (this is for KMS). CSEK is where keys are created outside GCP and used by API calls. So if customer has to create keys, it has to be outside KMS
Best Option: This is the most accurate approach. Cloud KMS provides the ability to create, manage, and rotate encryption keys. You can use the KMS API to reference the keys when encrypting and decrypting your data. In this case, you would integrate the KMS keys into your application logic (e.g., Kafka producers/consumers, Redis clients) to encrypt and decrypt data as it is stored or processed. This approach leverages the full functionality of Cloud KMS, including the ability to rotate and destroy keys as needed.