hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A Cloud KMS key used to encrypt a Cloud Storage…
A Cloud KMS key used to encrypt a Cloud Storage bucket's data is being destroyed. What happens to the data in the bucket when the KMS key is destroyed?
⚠ Common exam trap
Google Cloud often tests the misconception that destroying a KMS key triggers automatic data deletion or that Google provides a fallback re-encryption mechanism, when in fact the data remains but is cryptographically erased and unrecoverable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The encrypted data becomes permanently inaccessible (cryptographic erasure) since the decryption key no longer exists.
When a Cloud KMS key is destroyed, the encrypted data in Cloud Storage becomes permanently inaccessible because the cryptographic key material is irrecoverably deleted. This is known as cryptographic erasure: without the key, the ciphertext cannot be decrypted, even though the raw encrypted bytes still exist in the bucket. Cloud Storage does not store a copy of the KMS key, and there is no fallback mechanism to re-encrypt or recover the data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The data in Cloud Storage is automatically deleted along with the key.
Why it's wrong here
Destroying a KMS key does not issue any delete command to Cloud Storage. The object's ciphertext stays in the bucket, continues to occupy storage space, and may still incur storage charges. No lifecycle rule or background process removes objects whose wrapping key has been destroyed, so the data is still present — it is simply inaccessible.
- ✓
The encrypted data becomes permanently inaccessible (cryptographic erasure) since the decryption key no longer exists.
Why this is correct
Cloud Storage objects are encrypted with envelope encryption: a data encryption key (DEK) is generated per object and then wrapped by the Cloud KMS key. When that KMS key is destroyed, the DEK can never be unwrapped, so the ciphertext bytes in Cloud Storage remain but are mathematically unreadable. This is cryptographic erasure — effective deletion without physically deleting the stored object.
- ✗
Cloud Storage automatically re-encrypts the data using Google-managed keys as a fallback.
Why it's wrong here
Cloud Storage cannot automatically re-encrypt the objects with Google-managed keys because re-encryption requires reading the plaintext, which is impossible once the KMS key is gone. The DEK is wrapped and unreadable without the destroyed key, and Google does not retain a copy of the plaintext or a fallback key that could unwrap an already-wrapped DEK. The entire purpose of customer-managed key destruction is to make any such recovery impossible.
- ✗
The key enters a 'disabled' state where data can still be decrypted by Google support.
Why it's wrong here
Key destruction is permanent and irreversible, whereas disabling a key is a temporary, reversible administrative action. When a key is destroyed, Cloud KMS deletes the key material immediately, so even Google Support has no access to it and cannot decrypt the data. A disabled key still exists and could be re-enabled, but a destroyed key does not — so this answer mischaracterizes the event as disabling.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.