Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company uses Cloud SQL for MySQL and wants to ensure that data is encrypted at rest using customer-managed keys. They also need to rotate the key every 90 days. What should they do?
⚠ Common exam trap
Test-takers frequently confuse CSEK (Compute Engine/Cloud Storage) with CMEK (Cloud SQL, BigQuery, etc.) and assume any customer-managed key option works for Cloud SQL, or they think default Google-managed keys can be rotated by the customer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CMEK on the Cloud SQL instance and rotate the key in Cloud KMS
Cloud SQL supports Customer-Managed Encryption Keys (CMEK) via integration with Cloud KMS. By enabling CMEK on the Cloud SQL instance, you can use a key you create and manage in Cloud KMS, and you can set a rotation period (e.g., 90 days) on that key in Cloud KMS. This ensures data at rest is encrypted with a key you control and that is automatically rotated according to your schedule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use customer-supplied encryption keys (CSEK) with Cloud SQL
Why it's wrong here
Cloud SQL does not support customer-supplied encryption keys (CSEK). CSEK is a feature available to Compute Engine and Cloud Storage, where you provide raw key material directly to the service for encryption. Since Cloud SQL requires a Cloud KMS-managed key for customer-managed encryption, CSEK cannot be used to encrypt Cloud SQL data or manage its key lifecycle.
- ✗
Use default Google-managed encryption and rotate the key using Cloud KMS
Why it's wrong here
Default encryption for Cloud SQL uses Google-managed keys, which are automatically rotated and operated entirely by Google on your behalf. These keys are not exposed to the customer, so you cannot rotate them through Cloud KMS—there is no key resource in your Cloud KMS project to rotate. Therefore, attempting to satisfy a key-rotation requirement by rotating a Google-managed key is not technically possible.
- ✓
Enable CMEK on the Cloud SQL instance and rotate the key in Cloud KMS
Why this is correct
Enabling CMEK on a Cloud SQL instance lets you associate a customer-managed key from Cloud KMS with the instance at creation time. You can rotate the key in Cloud KMS by creating a new key version and setting it as the primary version; Cloud SQL automatically uses the new primary version without reconfiguring the instance. This gives you full control over key lifecycle and rotation, meeting the requirement.
- ✗
Bring your own key (BYOK) without using Cloud KMS
Why it's wrong here
Bringing your own key (BYOK) without Cloud KMS is not a supported pattern for Cloud SQL. Even if you have your own key material, it must first be imported into Cloud KMS and then used as a CMEK key to encrypt the Cloud SQL instance. Without Cloud KMS integration, Cloud SQL has no mechanism to accept or manage external keys, so you cannot control or rotate them.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.