Cloud Digital Leader Trust and security with Google Cloud Practice Question
A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?
⚠ Common exam trap
The trap is confusing CSEK with CMEK: CSEK are customer-supplied and not managed by Cloud KMS, so they lack automated rotation; CMEK is the correct choice for managed rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use customer-managed encryption keys (CMEK) with Cloud KMS
Customer-managed encryption keys (CMEK) with Cloud KMS allow the customer to create and manage their own keys in Cloud KMS, and use them to encrypt data in Cloud Storage. The customer can rotate the key monthly via Cloud KMS key rotation schedules. This meets the requirement of self-managed keys with monthly rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use customer-supplied encryption keys (CSEK)
Why it's wrong here
CSEK lets you supply your own raw AES-256 keys for encrypting rest data, but for Cloud Storage it is deprecated in favor of CMEK. Because you provide key bytes per request and Google never stores them, rotating keys requires you to re-encrypt data and manage versions externally, making scheduled monthly rotation cumbersome and inconsistent with the stated requirement.
- ✗
Use default Google-managed encryption keys
Why it's wrong here
With default encryption, data is protected by Google-managed keys that Google rotates automatically on its own schedule, but you have no visibility or control over rotation timing. There is no API to force or schedule a rotation, so you cannot meet a monthly rotation compliance requirement; you also cannot manage access or separate keys per bucket.
- ✓
Use customer-managed encryption keys (CMEK) with Cloud KMS
Why this is correct
CMEK with Cloud KMS gives you direct control over the encryption key, including the ability to set automatic rotation every 30 days via the rotation period parameter and to manually rotate at any time. Data in Cloud Storage is encrypted with a data encryption key (DEK), which itself is wrapped by a key encryption key (KEK) managed in Cloud KMS, and you can grant or revoke IAM permissions to enforce separation of duties.
- ✗
Use server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C is a server-side encryption mode defined by the S3 API, not a feature of Google Cloud Storage; in S3 you supply encryption keys with each request. Attempting to use SSE-C with Cloud Storage is invalid, and the closest Google equivalent would be CSEK, which also carries limitations. Thus, this option does not address the startup's requirement because the service would reject it as unsupported.
Go deeper
Related to this question
Learn chapter
ML Lifecycle: Data, Training, Deployment
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
Key term
KMS
KMS (Key Management Service) is a Microsoft technology that automates volume licensing activation for Windows and Office products within an organization's network.
About these practice questions
Courseiva writes every GCDL question from scratch — 848 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.