Cloud Digital Leader Trust and security with Google Cloud Practice Question
A startup wants to automatically rotate encryption keys used for Cloud Storage objects every 90 days. Which service should they use?
⚠ Common exam trap
Candidates often confuse Cloud Secret Manager (which stores secrets but does not rotate encryption keys automatically) with Cloud KMS (which provides automatic key rotation), or they assume that default Google-managed encryption (SSE-GCP) allows customer-controlled rotation schedules, which it does not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud Key Management Service (KMS) with automatic rotation schedule
Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 90 days). When you create a key ring and key in Cloud KMS, you can set a rotation schedule, and Cloud KMS will automatically generate a new key version on the specified date. This allows the startup to meet the 90-day rotation requirement without manual intervention, and the new key version is used for encrypting new Cloud Storage objects while old versions remain available for decrypting existing data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud Secret Manager to store and rotate encryption keys
Why it's wrong here
Cloud Secret Manager is designed for storing sensitive data such as API keys, passwords, and certificates, but it is not an encryption key management system for Cloud Storage. While it supports versioned secrets, it cannot be integrated as a customer-managed key source for encrypting Cloud Storage objects, nor does it provide automatic key rotation for storage encryption. You would have to manually implement envelope encryption in your application, which bypasses the transparent encryption features of Cloud Storage and does not meet the requirement for automated 90-day key rotation.
- ✗
Use default Cloud Storage encryption (SSE-GCP)
Why it's wrong here
Default encryption for Cloud Storage uses Google-managed keys that are rotated at Google's discretion, but this does not allow you to specify a 90-day rotation schedule. With SSE-GCP, you have no visibility into the key rotation cadence and cannot audit or control when rotation occurs. Because the requirement explicitly asks for a defined automatic rotation period, using only Google-managed keys is insufficient; you need customer-managed keys to enforce your own rotation policy.
- ✗
Use Cloud HSM to store keys and rotate manually
Why it's wrong here
Cloud HSM provides hardware-based security for encryption keys, but the task specifically requires automatic rotation, not manual. If you manually rotate keys stored in Cloud HSM, you must handle versioning, propagation, and timing yourself, which is error-prone and likely to miss the 90-day window. Automatic rotation is a policy feature of Cloud Key Management Service, which can use HSM-protected keys, so relying on manual rotation with Cloud HSM alone does not satisfy the requirement.
- ✓
Use Cloud Key Management Service (KMS) with automatic rotation schedule
Why this is correct
Cloud KMS enables you to set an automatic rotation schedule for customer-managed keys; for example, you can set a rotation period of 90 days to align with your compliance policy. Once configured, KMS automatically generates a new key version at that interval and uses it to encrypt new data, while continuing to allow decryption of data encrypted with previous versions using the key's version history. Cloud Storage supports integration with KMS through customer-managed encryption keys (CMEK), giving you control over key lifecycle and rotation while meeting the 'automatic' requirement.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
KMS
KMS (Key Management Service) is a Microsoft technology that automates volume licensing activation for Windows and Office products within an organization's network.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.