Cloud Digital Leader Google Cloud Security Practice Question
A company wants to store encryption keys for encrypting data at rest in Cloud Storage, and also needs to automatically rotate the keys every 30 days. Additionally, they require an audit log of key usage. Which TWO services should they use? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud KMS
Cloud KMS allows creating and managing keys with automatic rotation (via rotation period). Cloud Audit Logs can be configured to log every use of the key (Data Access audit logs). Secret Manager is for secrets, not encryption keys. Cloud HSM provides hardware-backed keys but is part of Cloud KMS. Cloud Storage itself does not manage key rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud HSM
Why it's wrong here
Cloud HSM is a hardware security module service that operates as an extension of Cloud KMS, providing tamper-resistant hardware protection for cryptographic keys. However, it is not a standalone key management solution; it still requires Cloud KMS to handle key lifecycle, rotation, and IAM policies. Thus, for a company storing encryption keys for data encryption, Cloud KMS remains the necessary central service, and Cloud HSM alone would not suffice.
- ✗
Secret Manager
Why it's wrong here
Secret Manager is designed to store secrets such as API keys, passwords, and certificates, and it excels at securely managing access to those secrets within applications. Encryption keys, however, require cryptographic operations, versioning, and rotation policies that Secret Manager does not natively support. While it can technically hold key material, it lacks the key management features of Cloud KMS, making it an incorrect choice for storing encryption keys intended for encryption.
- ✓
Cloud KMS
Why this is correct
Cloud KMS is the correct choice because it is the Google Cloud service purpose-built for creating, storing, and managing encryption keys. It supports symmetric and asymmetric keys, automatic rotation, and fine-grained IAM controls, and it integrates with Cloud Storage, BigQuery, Compute Engine, and other services for seamless data encryption. Keys are kept in a centralized, secure environment, and you can use them to encrypt and decrypt data without exposing the raw key material.
- ✓
Cloud Audit Logs
Why this is correct
Cloud Audit Logs is correct as a complement to Cloud KMS because it records a detailed, immutable audit trail of all key operations, including generation, rotation, decryption attempts, and administrative actions. This logging is essential for compliance frameworks like HIPAA and PCI-DSS, which require evidence of key access and monitoring. Although Cloud Audit Logs does not store the encryption keys themselves, it is a vital service to include in a comprehensive encryption key management solution for governance and auditability.
- ✗
Cloud Storage
Why it's wrong here
Cloud Storage is an object storage service for storing arbitrary data at scale, but it is not optimized for managing encryption keys. Placing keys in a Cloud Storage bucket would not provide key rotation, versioning, or cryptographic integration with other services, and it would also expose raw key material to anyone with bucket access. For proper key lifecycle management and secure encryption, Cloud KMS is the appropriate service, not Cloud Storage.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
Key term
KMS
KMS (Key Management Service) is a Microsoft technology that automates volume licensing activation for Windows and Office products within an organization's network.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.