Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The instance becomes unavailable until the key rotation is complete.

  Why it's wrong here

  This is incorrect because Cloud SQL does not block requests while the Cloud KMS key version is being rotated. The instance continues to serve reads and writes using the existing key version for decryption, so the rotation itself does not cause a prolonged outage. Only a brief restart may be required later, but that is a separate operation and not a wait for 'rotation completion.'

• ✗

  All data in the instance is re-encrypted immediately.

  Why it's wrong here

  This is a common misunderstanding: rotating a CMEK key version does not trigger an immediate, full re-encryption of every row or page in the instance. Instead, Cloud SQL uses an envelope-encryption model where existing storage files remain encrypted with the old key version until they are rewritten by normal write activity. Immediate re-encryption only affects data that is written after the new key version becomes active, not the entire dataset at rotation time.

• ✓

  The instance must be stopped and restarted after the key rotation.

  Why this is correct

  This is the correct operational behavior. After rotating the key version in Cloud KMS, you must restart the Cloud SQL instance using the console, gcloud command, or API so that it recognizes the new key version as the encryption key for upcoming writes. The restart is required because the instance caches the old key version in memory, and the new version is only picked up during instance startup. This allows existing data to still be decrypted with the prior version while new encrypted data uses the updated version.

• ✗

  There is no impact; the instance automatically uses the new key version.

  Why it's wrong here

  This is false because Cloud SQL does not automatically detect that you rotated the CMEK key in Cloud KMS and switch to the new version on the fly. Without an explicit restart, the instance will continue using the original key version for all new data encryption, and the rotation is not applied. Auto-rotation of the underlying Google key would be transparent, but customer-managed key rotation requires manual action from the user.

Go deeper

Related to this question