Cloud Digital Leader Trust and security with Google Cloud Practice Question
A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use customer-managed encryption keys (CMEK) with Cloud KMS
Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) allows customers to control and rotate keys. CSEK is deprecated and less flexible. SSE-C is not available in Cloud Storage. Default encryption is Google-managed and cannot be rotated by the customer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use customer-supplied encryption keys (CSEK)
Why it's wrong here
CSEK lets you supply your own raw AES-256 keys for encrypting rest data, but for Cloud Storage it is deprecated in favor of CMEK. Because you provide key bytes per request and Google never stores them, rotating keys requires you to re-encrypt data and manage versions externally, making scheduled monthly rotation cumbersome and inconsistent with the stated requirement.
- ✗
Use default Google-managed encryption keys
Why it's wrong here
With default encryption, data is protected by Google-managed keys that Google rotates automatically on its own schedule, but you have no visibility or control over rotation timing. There is no API to force or schedule a rotation, so you cannot meet a monthly rotation compliance requirement; you also cannot manage access or separate keys per bucket.
- ✓
Use customer-managed encryption keys (CMEK) with Cloud KMS
Why this is correct
CMEK with Cloud KMS gives you direct control over the encryption key, including the ability to set automatic rotation every 30 days via the rotation period parameter and to manually rotate at any time. Data in Cloud Storage is encrypted with a data encryption key (DEK), which itself is wrapped by a key encryption key (KEK) managed in Cloud KMS, and you can grant or revoke IAM permissions to enforce separation of duties.
- ✗
Use server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C is a server-side encryption mode defined by the S3 API, not a feature of Google Cloud Storage; in S3 you supply encryption keys with each request. Attempting to use SSE-C with Cloud Storage is invalid, and the closest Google equivalent would be CSEK, which also carries limitations. Thus, this option does not address the startup's requirement because the service would reject it as unsupported.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
SSE
SSE (Security Service Edge) is a cloud-delivered security framework that converges web, cloud, and private access controls at the network edge.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.