mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Is running a batch job that processes sensitive…
An organization is running a batch job that processes sensitive data. The job writes output to a Cloud Storage bucket. The security team requires that all data at rest be encrypted with a customer-managed key. Which key type should be used?
⚠ Common exam trap
Google Cloud often tests the distinction between key types (CMEK, CSEK, Google-managed) and key protection methods (Cloud HSM, Cloud KMS), so the trap here is confusing Cloud HSM (a key protection option) with a key type, or thinking CSEK is still the recommended customer-managed approach for Cloud Storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud KMS CMEK
Cloud KMS CMEK (Customer-Managed Encryption Keys) is the correct choice because it allows the organization to control and manage the encryption keys used to protect data at rest in Cloud Storage, meeting the security team's requirement for customer-managed keys. CMEK keys are created and managed in Cloud KMS, and you can control key rotation, access, and lifecycle, ensuring compliance with regulatory mandates for customer-managed encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud HSM
Why it's wrong here
Cloud HSM is not a key type or encryption option; it is a hardware security module service that provides FIPS 140-2 Level 3 validated cryptographic hardware for key operations. While it can be used to protect keys in Cloud KMS when you attach a Cloud HSM key ring, the encryption itself is still performed using keys managed by Cloud KMS, so selecting Cloud HSM alone does not give you customer-managed keys. For a batch job requiring control over encryption keys, Cloud HSM is an implementation detail, not a substitute for CMEK.
- ✗
Default encryption (Google-managed)
Why it's wrong here
Default encryption uses Google-managed keys, which means Google Cloud encrypts data at rest on your behalf but you do not have the ability to view, rotate, or revoke the keys. This is the simplest option but does not meet a requirement for customer control over encryption keys. Since the organization needs to satisfy specific regulatory or compliance obligations around key ownership, default encryption lacks the governance and audit capabilities provided by customer-managed keys.
- ✗
Customer-supplied encryption keys (CSEK)
Why it's wrong here
Customer-supplied encryption keys (CSEK) allow you to provide your own key for each individual object or operation, and Google Cloud does not store the key persistently; you must supply it with every API call. CSEK is not integrated with Cloud KMS, so it does not provide centralized key management, rotation, or IAM-based access control required for a batch job environment. Additionally, CSEK only applies to object-level encryption, not to the broader set of resources or services that support Cloud KMS customer-managed keys.
- ✓
Cloud KMS CMEK
Why this is correct
Cloud KMS customer-managed encryption keys (CMEK) give the organization direct control over the key material used to encrypt data at rest, including the ability to enable, disable, rotate, and set IAM policies on the key. With CMEK, you create the key in Cloud KMS and then specify that key as the encryption key for the batch job's storage or compute resource, ensuring that no one outside your organization's IAM policy can access the decryption key. This satisfies compliance requirements for customer-managed keys while leveraging Google's managed encryption infrastructure.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.