Cloud Digital Leader Why Cloud Technology Can Transform Business Practice Question
A company is moving a sensitive database to Cloud SQL. They need to encrypt data at rest using customer-managed encryption keys (CMEK) and rotate the key every 30 days. How should they set this up?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a key in Cloud KMS, specify it as the CMEK for Cloud SQL, and set rotation period to 30 days
Cloud KMS allows managing keys outside the service, and you can set an automatic rotation period of 30 days. Cloud HSM provides hardware-backed keys but is not required. Protecting the key with IAM is separate. Enabling encryption by default uses Google-managed keys, not CMEK.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption by default in Cloud SQL settings
Why it's wrong here
Cloud SQL always encrypts data at rest by default, but the built-in default encryption uses Google-managed keys, which do not give the customer control over key lifecycle or rotation. Enabling this setting alone would not satisfy a requirement for a customer-managed encryption key (CMEK), so it cannot meet the stated need.
- ✗
Use Cloud HSM to generate a key and import it to Cloud SQL
Why it's wrong here
Cloud HSM provides FIPS 140-2 level 3 validated hardware protection for keys, but Cloud SQL expects the key to be created and managed in Cloud KMS, with Cloud HSM as the protection level. Merely generating a key in HSM and 'importing' it to Cloud SQL is not a supported flow, and the option does not configure the required 30-day rotation, so it is incomplete.
- ✗
Create a key in Cloud KMS and manually rotate it each month
Why it's wrong here
Creating a key in Cloud KMS is a necessary step, but the requirement specifies an automatic 30-day rotation period. Manual rotation each month relies on an operator and is prone to missed rotations or compliance gaps, and the key also needs to be explicitly assigned as the CMEK for the Cloud SQL instance to take effect.
- ✓
Create a key in Cloud KMS, specify it as the CMEK for Cloud SQL, and set rotation period to 30 days
Why this is correct
This is the correct configuration: create a key in Cloud KMS, designate it as the customer-managed encryption key (CMEK) for the Cloud SQL instance, and set the rotation period to 30 days. Cloud KMS then automatically rotates the key material every 30 days, and Cloud SQL transparently re-encrypts data with the new key version, meeting the company's compliance requirement without manual intervention.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.