Cloud Digital Leader Google Cloud Security Practice Question
A company needs to encrypt data at rest using keys that they manage, but they want to reduce operational overhead by having Google Cloud host the key management infrastructure. Which TWO options achieve this? (Choose 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud HSM
CMEK uses Cloud KMS to manage keys, which Google hosts. CSEK requires the customer to supply and manage keys outside Google. Google-managed keys are not customer-managed. Cloud HSM is a hardware security module that can be used with CMEK. Secret Manager is for secrets, not encryption keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Secret Manager
Why it's wrong here
Secret Manager is a service for securely storing and managing API keys, passwords, and certificates as secret strings. It does not manage cryptographic keys for data encryption, lacks the key rotation and versioning features needed for encryption key lifecycles, and cannot be directly integrated with Google Cloud services to encrypt data at rest. Using Secret Manager would not satisfy a requirement to manage encryption keys.
- ✗
Google-managed encryption keys
Why it's wrong here
Google-managed encryption keys are the default encryption keys that Google Cloud automatically applies to all data at rest. These keys are generated, stored, and rotated by Google without customer involvement, giving customers no ability to control the key material, set IAM policies, or perform cryptographic operations on demand. Since the company needs to manage or control the keys, this option fails to provide the required level of customer control.
- ✗
Customer-supplied encryption keys (CSEK)
Why it's wrong here
Customer-supplied encryption keys (CSEK) require customers to provide their own key material and manage key storage, rotation, and lifecycle entirely outside Google Cloud. Google uses the key to encrypt data but does not persist it, and if the key is lost, data becomes unrecoverable; moreover, CSEK keys are not integrated with Cloud KMS and do not provide centralized audit or access control. This places the operational burden solely on the customer, unlike a managed key service.
- ✓
Cloud HSM
Why this is correct
Cloud HSM is a fully managed hardware security module that provides FIPS 140-2 Level 3 validated protection for cryptographic keys. When used with Cloud KMS, Cloud HSM services generate and store customer-managed keys within tamper-resistant hardware, ensuring keys never leave the HSM boundary while enabling encryption of data at rest across Google Cloud services. This directly meets the requirement for the company to control keys with hardware-backed security and simplifies compliance.
- ✓
Customer-managed encryption keys (CMEK)
Why this is correct
Customer-managed encryption keys (CMEK) allow organizations to create and manage their own encryption keys in Cloud KMS and use them to protect data at rest in supported Google Cloud services. With CMEK, customers control key lifecycle operations such as rotation, disabling, and revocation, and can define granular IAM permissions for who can use or manage the keys. However, CMEK by default uses software-backed keys unless configured with Cloud HSM, so it is the broader control mechanism but not the HSM-backed implementation itself.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.