Cloud Digital Leader Fundamental Cloud Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud HSM

  Why it's wrong here

  Cloud HSM is a dedicated hardware security module service that provides FIPS 140-2 Level 3 certified HSM capacity for cryptographic operations. While it can be used as the backing crypto engine for keys managed by Cloud KMS, Cloud HSM does not itself provide the key management control plane—there is no API to create, rotate, or set IAM policies on keys. To use customer-managed encryption keys (CMEK), you must create and manage them in Cloud KMS and optionally choose an HSM-backed key, making Cloud HSM a lower-level component rather than the management service itself.

• ✗

  Identity-Aware Proxy (IAP)

  Why it's wrong here

  Identity-Aware Proxy (IAP) is an access-control layer that verifies a user's identity and evaluates contextual attributes before allowing them to reach an application, VM, or service. It operates at the network/application boundary and has no role in how data at rest is encrypted. IAP does not create, store, or manage encryption keys, nor does it integrate with Google Cloud's CMEK workflow; it simply gates who can use a resource, not how that resource protects its data.

• ✓

  Cloud Key Management Service (Cloud KMS)

  Why this is correct

  Cloud Key Management Service (Cloud KMS) is the core service for customer-managed encryption keys (CMEK), allowing you to create, import, rotate, disable, and destroy keys that control the encryption of data in Google Cloud services like Cloud Storage, Compute Engine, and BigQuery. When you use CMEK, each service requests the key from Cloud KMS to perform envelope encryption, and Cloud KMS enforces IAM-based permissions and audit logging on every key operation. This gives customers the ability to manage the full key lifecycle, making Cloud KMS the correct choice for the stated requirement.

• ✗

  Secret Manager

  Why it's wrong here

  Secret Manager is designed for securely storing sensitive credentials such as API keys, OAuth tokens, passwords, and certificates, typically for use by applications at runtime. It does not manage encryption keys for data at rest; its API lacks the key versioning, rotation scheduling, and cryptographic operations found in Cloud KMS. Although you could theoretically store an encryption key as a secret, Secret Manager does not provide the key-specific controls or native integration with Google Cloud's data services needed to govern encryption, so it is not the appropriate service for CMEK.

Go deeper

Related to this question