hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A healthcare company stores patient data in Cloud…
A healthcare company stores patient data in Cloud Storage. Compliance requires that even GCP (Google) cannot decrypt this data. The company manages encryption keys entirely on their own infrastructure. Which encryption option satisfies this?
⚠ Common exam trap
Watch out — candidates often confuse CMEK with CSEK, assuming that managing keys in Cloud KMS gives the customer exclusive control, but CMEK still allows Google to access the key material via the KMS service, whereas CSEK ensures Google never stores the key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer-Supplied Encryption Keys (CSEK) provided with each API request
Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own AES-256 encryption key with each API request to Cloud Storage. Google does not store the key; it is used only in memory to encrypt/decrypt the data and then discarded, ensuring that even Google cannot access the plaintext. This meets the compliance requirement that the customer retains exclusive control over the encryption keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS
Why it's wrong here
With CMEK, the key is stored in Cloud KMS (a Google-managed service). While the customer controls access to the key, Google's infrastructure hosts it — regulators may require the key to never touch Google's systems.
- ✓
Customer-Supplied Encryption Keys (CSEK) provided with each API request
Why this is correct
CSEK requires the customer to supply the encryption key with every API request. GCP uses the key transiently and never stores it — Google cannot access data without the customer providing the key each time.
- ✗
Google-managed encryption keys (default) with restricted IAM policies
Why it's wrong here
Default Google-managed encryption means the key material is owned and held by Google within its own key management infrastructure. While the data is encrypted at rest, Google retains the technical ability to decrypt it because custody of the key never leaves Google's systems. Restricting IAM policies only limits which Google Cloud principals can call data-plane APIs; it does not change the fact that Google controls the encryption keys, so it cannot satisfy a requirement that Google have no ability to access the plaintext.
- ✗
Shielded VM with confidential computing for the VMs that access the data
Why it's wrong here
Shielded VM and confidential computing (Confidential VMs) protect the integrity and confidentiality of compute instances, including data in memory during processing. Shielded VMs ensure firmware/boot integrity and Confidential VMs use AMD SEV to encrypt memory, but neither mechanism affects how Cloud Storage objects are encrypted at rest or who holds the storage encryption keys. Even if all data-accessing VMs are shielded/confidential, the data stored in GCS remains encrypted with keys managed by Google unless CSEK/CMEK is explicitly used, so this option does not address the regulatory requirement.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.