Google ACE Practice Question: A Cloud Storage bucket contains sensitive PII data

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Google-managed encryption keys (default).

  Why it's wrong here

  Google-managed encryption keys are the default and require no configuration, but they are controlled entirely by Google, not by your security team. Google handles rotation, storage, and access, but you cannot revoke the key, schedule your own rotation, or get a separate audit trail that shows each key was used. This contradicts the stated requirement that your security team must manage the keys, so this option would not meet the compliance or governance need.

• ✓

  Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.

  Why this is correct

  CMEK with Cloud KMS is the correct choice because it lets your security team directly manage the full lifecycle of the encryption key — creating it in a dedicated key ring, rotating it on a schedule, setting IAM permissions for who can use or manage it, and most importantly disabling or destroying it. Disabling the key immediately blocks all access to data encrypted under it (cryptographic shredding) without waiting for storage deletion, and every use of the key is recorded in Cloud Audit Logs. This gives auditors a clear, independent chain of custody over the encryption material, which satisfies internal security requirements that Google-managed keys cannot.

• ✗

  Enable Cloud Storage's built-in server-side encryption with AES-256.

  Why it's wrong here

  Cloud Storage always applies server-side AES-256 encryption to objects at rest, but the built-in option uses Google-managed keys. While this protects data against external attackers, it does not give your security team any ability to rotate, revoke, or independently audit the encryption key. Enabling this option would still leave key management entirely in Google's hands, so it fails the requirement for your team to control the key lifecycle.

• ✗

  Use Customer-Supplied Encryption Keys (CSEK) by embedding the key in each API request.

  Why it's wrong here

  CSEK lets you supply your own AES-256 key in each API call, and Cloud Storage uses that key to encrypt and decrypt the object. However, this requires your application to manage and transmit the key on every request, creating serious operational overhead and a higher risk of key leakage in logs or network payloads. CMEK with Cloud KMS is the managed alternative: you retain control over the key material and lifecycle, but Cloud KMS handles secure storage and automatic access, so you avoid embedding keys in API requests.

Go deeper

Related to this question