Google ACE Configuring Access and Security Practice Question
An organization wants to enforce encryption at rest for all data in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have created a Cloud KMS key ring and key. What additional step is required when creating a new bucket to use CMEK?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the `--default-encryption-key` flag with the KMS key resource ID in the `gsutil mb` command.
When creating a bucket with CMEK, you must specify the `--default-encryption-key` flag with the KMS key resource ID. This sets the default encryption key for objects stored in the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the `--encryption-key` flag in the `gsutil mb` command.
Why it's wrong here
The `--encryption-key` flag is not a valid option for `gsutil mb`; it is used with `gsutil cp` or `gsutil rsync` to apply a specific encryption key to individual object operations. To establish a bucket-wide default encryption key at creation, you must use `--default-encryption-key` instead, and pass the full KMS key resource ID, not just a key name. Attempting to use the former flag on `gsutil mb` will result in a command-line parsing error or be silently ignored.
- ✓
Use the `--default-encryption-key` flag with the KMS key resource ID in the `gsutil mb` command.
Why this is correct
The `--default-encryption-key` flag, when used with `gsutil mb`, sets the bucket's default customer-managed encryption key at creation time. The value must be the full resource ID in the format `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY`. This ensures every object uploaded to the bucket is automatically encrypted with that KMS key, enforcing encryption at rest for all data without requiring per-object flags.
- ✗
Assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.
Why it's wrong here
Assigning the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account is a necessary IAM prerequisite, allowing Cloud Storage to encrypt and decrypt objects using the specified key. However, this role assignment alone does not create a bucket nor set the default key; it must be combined with either the `gsutil mb --default-encryption-key` command or the equivalent API/console configuration. Since the question asks for the specific step at the time of bucket creation, this IAM change is not the correct answer, as it is a separate configuration step that must occur beforehand.
- ✗
Enable CMEK in the Cloud Console under the bucket's encryption settings after creation.
Why it's wrong here
Although Cloud Storage allows you to change the default encryption key of an existing bucket through the Cloud Console bucket settings, the question explicitly asks about the step when creating a new bucket. In the Console's bucket creation flow, you must choose the customer-managed key during the 'Choose how to protect object data' step; there is no post-creation toggle that retroactively sets the key for a new bucket. Therefore, enabling CMEK after creation is not the action taken at bucket creation time and does not satisfy the requirement.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.