Cloud Digital Leader Google Cloud Security Practice Question
An organization needs to ensure that data stored in Cloud Storage is encrypted at rest using keys that are rotated every 30 days. They also need to audit who accesses the keys and when. Which THREE services should they use? (Choose 3)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Audit Logs
Cloud KMS manages key rotation. Cloud Audit Logs record key access. Cloud Storage stores the data. Cloud HSM can be used but is not required for the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud HSM
Why it's wrong here
Cloud HSM provides hardware-backed keys for enhanced cryptographic security, but it is not a prerequisite for key rotation. Cloud KMS can automatically rotate software-generated keys without an HSM, so the absence of an HSM does not hinder key lifecycle management. Moreover, an HSM alone does not address the requirement to track key usage, which is the primary goal here.
- ✓
Cloud Audit Logs
Why this is correct
Cloud Audit Logs records both admin activity and data access events, including every call to decrypt data with a Cloud KMS key. By enabling Data Access audit logs for Cloud KMS, the organization gains a detailed trail of who accessed which key, when, and from what context, enabling anomaly detection and compliance audits. This visibility is essential for verifying that key rotation policies are enforced and that keys are not misused.
- ✗
Secret Manager
Why it's wrong here
Secret Manager is purpose-built for storing application secrets like passwords, API tokens, and database credentials, not for managing customer-managed encryption keys. While it can store arbitrary sensitive strings, it lacks the cryptographic key versioning and rotation APIs that Cloud KMS provides for integrated encryption with Cloud Storage. Therefore, it is the wrong service for the key rotation requirement.
- ✓
Cloud Storage
Why this is correct
Cloud Storage is the service that stores the encrypted objects at rest; when CMEK is enabled, data is encrypted with a key managed by Cloud KMS before being written to buckets. Cloud Storage does not manage or rotate encryption keys itself—it simply uses the specified key to encrypt and decrypt blobs. Thus, it is a necessary component but not the solution for key lifecycle management.
- ✓
Cloud KMS
Why this is correct
Cloud KMS is the central service that manages cryptographic keys and supports automatic rotation by creating new key versions on a defined schedule. It integrates with Cloud Storage via CMEK, ensuring that new data is encrypted with the latest key version while old data remains decryptable with prior versions. This allows the organization to enforce rotation policies without manual re-encryption, meeting the key management requirement.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.