Google ACE Practice Question: Your company's compliance policy requires that…

Your company's compliance policy requires that all customer data stored in Cloud Storage must be encrypted using keys stored in a Hardware Security Module (HSM). The encryption keys must be managed by your security team and must not be exportable. Which configuration meets these requirements?

⚠ Common exam trap

Google Cloud often tests the distinction between customer-managed keys (CMEK) and customer-supplied keys (CSEK), where candidates mistakenly think CSEK provides HSM-level protection or that Google-managed encryption can be configured to use an HSM, but neither meets the non-exportable, HSM-backed requirement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use Cloud KMS HSM-backed keys (protection level: HSM) with Cloud Storage CMEK.

Cloud KMS HSM-backed keys (protection level: HSM) ensure that encryption keys are stored in a Hardware Security Module, are managed by the security team, and are non-exportable by design. When used with Cloud Storage CMEK, this configuration meets the compliance requirement for HSM-based key storage with full customer control and no key export capability.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use Cloud KMS software keys (protection level: SOFTWARE) with Cloud Storage CMEK.
Why it's wrong here
Cloud KMS software keys (protection level: SOFTWARE) are generated and stored inside Cloud KMS's software-based cryptographic boundaries, not in FIPS 140-2 Level 3 validated HSM hardware. Because they are not HSM-backed, they do not meet a compliance mandate for hardware-backed, non-exportable key material. Even though you control the key lifecycle, software keys are inherently more exportable than HSM keys, so they fail the non-exportability requirement as well.
✓
Use Cloud KMS HSM-backed keys (protection level: HSM) with Cloud Storage CMEK.
Why this is correct
HSM protection level keys are generated and stored inside FIPS 140-2 Level 3 HSMs. They are non-exportable by design. CMEK with Cloud KMS HSM keys gives your team control while meeting HSM and non-exportability requirements.
✗
Use Customer-Supplied Encryption Keys (CSEK) managed by your security team.
Why it's wrong here
Customer-Supplied Encryption Keys (CSEK) require you to provide raw AES-256 key material with every Cloud Storage API call, meaning your security team must maintain that key externally, outside Google's HSM infrastructure. CSEK is not integrated with Cloud KMS and has no HSM backing in Google Cloud, so the key material never resides in a FIPS 140-2 Level 3 HSM. This design violates the HSM residency requirement and also fails the non-exportability test because you are forced to expose the key to Google's service on each request.
✗
Enable Google-managed encryption with HSM by selecting it in Cloud Storage settings.
Why it's wrong here
Google-managed encryption is the default encryption for Cloud Storage, where Google fully owns, generates, and rotates the keys with no customer control. There is no user-facing option in Cloud Storage settings to select HSM for Google-managed keys; the protection level is only configurable when creating a Cloud KMS key for CMEK. Since the security team has no control over the key material or lifecycle, this approach cannot satisfy the requirements for customer control and HSM-backed, non-exportable keys.

Go deeper

Google ACE Practice Question: Your company's compliance policy requires that…

Why each option matters

Option-by-option breakdown

Related to this question