Cloud Digital Leader Google Cloud Security Practice Question
A company wants to encrypt sensitive data stored in Cloud Storage with a key that is generated and stored on-premises using a hardware security module (HSM). They do not want Google to have access to the key. Which encryption option should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer-supplied encryption keys (CSEK)
Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own keys; Google does not store the key and has no access to it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Google-managed encryption keys
Why it's wrong here
Google-managed encryption keys are the default encryption-at-rest mechanism in Google Cloud, where the cloud provider fully generates, stores, and rotates the keys. The customer has no visibility or control over the key material, and Google retains the ability to access the keys at the infrastructure level. This fails the company's requirement because the customer cannot enforce its own key lifecycle policies or ensure that Google cannot access the data.
- ✗
Customer-managed encryption keys (CMEK)
Why it's wrong here
Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in Cloud KMS, giving control over rotation, enablement, and usage. However, the actual key material is generated and stored on Google's KMS infrastructure, meaning Google still technically retains access to the key material within its systems. This offers more control than Google-managed keys but does not satisfy a requirement that Google have no access whatsoever, as the keys reside within Google's cloud environment.
- ✗
Cloud HSM
Why it's wrong here
Cloud HSM provides a hardware security module (HSM) service where customers can generate and use keys for cryptographic operations, but the physical HSMs are owned and managed by Google. The customer controls logical policies but does not have physical custody, and Google's administrators maintain operational access to the HSM hardware. Consequently, this option does not meet the 'no Google access' requirement; it is a managed service that still relies on Google's trust boundary for hardware and underlying key storage.
- ✓
Customer-supplied encryption keys (CSEK)
Why this is correct
Customer-supplied encryption keys (CSEK) are keys that the customer generates and provides directly to Google Cloud via API when writing data. Google's systems use the customer-supplied key to encrypt the data at rest and then destroy the key from its memory, ensuring that Google does not retain the key material. This aligns with the company's requirement because the customer retains exclusive control over the key, and Google cannot access the plaintext without the customer re-supplying the key, making it the correct choice.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Hardware security module
A specialized hardware appliance that securely generates, stores, and manages cryptographic keys in a tamper-resistant environment for enterprise security systems.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.