Google ACE Deploying and Implementing a Cloud Solution Practice Question
A team is using Terraform to deploy infrastructure. They want to ensure that the Terraform state file is encrypted at rest using a customer-managed encryption key (CMEK). What should they configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Cloud Storage bucket with CMEK enabled by default; no Terraform configuration needed
To use CMEK with the GCS backend, you have two valid approaches: 1) Use an existing Cloud Storage bucket that already has CMEK enabled by default—no Terraform encryption configuration is needed because the bucket itself enforces encryption. 2) When creating a new bucket via the `google_storage_bucket` resource, set the `encryption` block with a `default_kms_key_name` to specify a CMEK key. The provider block does not have a `kms_key` argument, and the `terraform` backend block does not support a `kms_key` argument for GCS. Both options A and B are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a Cloud Storage bucket with CMEK enabled by default; no Terraform configuration needed
Why this is correct
Correct. If the Cloud Storage bucket already has CMEK enabled by default, no further Terraform configuration is required for encryption; the bucket's default key handles encryption at rest.
- ✓
Set the encryption block in the google_storage_bucket resource
Why this is correct
Correct. When creating a bucket with Terraform, use the `encryption` block with a `default_kms_key_name` to specify a CMEK key. This ensures the bucket uses CMEK.
- ✗
Set the kms_key argument in the google provider block
Why it's wrong here
Incorrect. The `google` provider block does not have a `kms_key` argument for configuring storage encryption. Provider settings do not control per-resource encryption.
- ✗
Set the kms_key argument in the terraform backend block
Why it's wrong here
Incorrect. The `terraform` backend block for GCS does not accept a `kms_key` argument. The backend uses the bucket's default encryption settings.
Go deeper
Related to this question
About these practice questions
This ACE question is part of Courseiva's 775-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.