Cloud Digital Leader Google Cloud Security Practice Question
A company uses Cloud Storage to store sensitive data. They want to enforce that all objects uploaded are encrypted with a customer-managed key that they can rotate and control. What should they configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set default encryption on the bucket to use a CMEK key from Cloud KMS.
Customer-Managed Encryption Keys (CMEK) allow customers to manage their own keys using Cloud KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use customer-supplied encryption keys (CSEK) for each upload.
Why it's wrong here
CSEK requires you to supply the raw key material with every single API request, which is impractical for persistent, bucket-wide encryption policies. Moreover, CSEK keys are not managed by Cloud KMS, so they cannot be centrally rotated, audited, or access-controlled, and the bucket itself has no default encryption configured for objects uploaded without explicit keys.
- ✗
Use Cloud HSM to generate a key and import it to Cloud KMS.
Why it's wrong here
Generating a key with Cloud HSM and importing it into Cloud KMS is a valid way to create a CMEK key, but it only creates the key. The missing step is configuring the bucket to use that key as its default encryption: you must explicitly set the bucket's default encryption to reference the CMEK key, otherwise objects will continue to be encrypted with a Google-managed key.
- ✓
Set default encryption on the bucket to use a CMEK key from Cloud KMS.
Why this is correct
Setting default encryption on a bucket to use a CMEK key from Cloud KMS is the correct action because it applies a customer-managed key to all new objects automatically, giving you control over key lifecycle, rotation, and permissions. This configuration satisfies the requirement for persistent, customer-controlled encryption without forcing per-request key management, and it integrates with Cloud KMS for auditing and access management.
- ✗
Enable default encryption with a Google-managed key.
Why it's wrong here
Enabling default encryption with a Google-managed key does encrypt data at rest, but the key is generated, stored, and rotated entirely by Google, so you cannot control or inspect the key material. This contradicts the stated requirement for customer-controlled encryption keys, and it means you have no ability to enforce custom rotation schedules or revoke access based on internal compliance policies.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.