Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Specify the key during instance creation using --disk-encryption-key, and ensure the Cloud SQL service account has encryption/decryption permissions on the key

  Why this is correct

  For Cloud SQL, customer-managed encryption keys (CMEK) must be supplied at the moment you create the instance. You specify the key with the --disk-encryption-key flag in the gcloud sql instances create command, and the Cloud SQL service account must be granted Cloud KMS CryptoKey Encrypter/Decrypter permissions so it can use the key to encrypt data at rest. If these permissions are missing, instance creation fails; the key cannot be retroactively attached to an existing instance because the encryption setting is immutable.

• ✗

  Create the instance without encryption, then use gcloud sql instances patch to add CMEK later

  Why it's wrong here

  You cannot enable CMEK on an existing Cloud SQL instance by patching it with gcloud sql instances patch or any other update operation. The disk encryption configuration is fixed at creation time and changing it later is unsupported; the only workaround is to create a new instance with the desired CMEK, migrate your data, and then delete the old instance. Therefore, patching to add CMEK after the fact is not a valid approach.

• ✗

  Enable CMEK by setting an organization policy that requires CMEK for all Cloud SQL instances

  Why it's wrong here

  Organization policies can impose constraints that require Cloud SQL instances to use CMEK, but the policy alone does not assign or select the actual key. Even when an org policy mandates CMEK, you still must explicitly provide a specific Cloud KMS key using --disk-encryption-key during instance creation, and your project must have the required key permissions. The org policy enforces that a key is present, but it does not perform the technical step of binding the key to the instance.

• ✗

  Use the default encryption; CMEK is not supported for Cloud SQL

  Why it's wrong here

  This option is false because Cloud SQL fully supports CMEK for all its database engines, including MySQL, PostgreSQL, and SQL Server. If you do not configure a CMEK, Cloud SQL automatically uses Google-managed encryption keys for at-rest encryption, but you are absolutely allowed to bring your own key through Cloud KMS. The statement that CMEK is unsupported for Cloud SQL directly contradicts documented functionality, so this approach would leave you with default encryption only, not compliance-grade customer-managed encryption.

Go deeper

Related to this question