Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Manually rotate the key every 90 days by generating a new key version.

  Why it's wrong here

  Manually generating a new key version does not automatically re-encrypt existing Cloud Storage objects with the new key material; those objects remain encrypted with the original key version, so the 90-day rotation requirement is not met for data at rest. This option is tempting because manual version creation is the correct approach when the goal is simply to enable new encryption for future writes, and it would be the right choice if the requirement applied only to new objects rather than to all existing encrypted objects.

• ✓

  Enable automatic rotation on the key with a 90-day period.

  Why this is correct

  Enabling automatic rotation with a 90-day period configures Cloud KMS to create a new primary key version every 90 days. All future Cloud Storage objects encrypted with this CMEK will use the new primary version, while older objects remain readable via their original key versions, which stay enabled for decryption. This satisfies the rotation requirement without forcing a rewrite or copy of existing data, since each key version is cryptographic material that can be retired on a future schedule.

• ✗

  Use Cloud HSM to generate a new key and update the bucket default encryption.

  Why it's wrong here

  Using Cloud HSM to generate a new key and then updating the bucket's default encryption is a manual, one-time action that swaps the key reference rather than performing periodic rotation. An HSM-backed key is still just a single Cloud KMS key; it does not automatically create new versions every 90 days, and changing the default encryption applies only to newly written objects. This approach does not establish an ongoing rotation lifecycle and fails the recurring 90-day requirement.

• ✗

  Create a new key and re-encrypt all existing objects using the new key.

  Why it's wrong here

  Creating a new key and re-encrypting all existing objects requires downloading and rewriting every object in the bucket, which introduces serious cost, latency, and availability risks, and provides no benefit because the earlier key versions can already decrypt those objects. More importantly, a one-time key replacement does not satisfy a recurring 90-day rotation policy; you would have to repeat the entire bulk rewrite cycle every quarter. Automatic rotation achieves compliance by changing the primary version used for new writes without moving a single object.

Go deeper

Related to this question