Cloud Digital Leader Google Cloud Security Practice Question
An organization needs to ensure that data stored in Cloud Storage is encrypted at rest using keys that are rotated every 30 days. They also need to audit who accesses the keys and when. Which THREE services should they use? (Choose 3)
⚠ Common exam trap
A common mix-up: candidates confuse Cloud HSM with Cloud KMS — candidates often select Cloud HSM thinking it's required for key rotation, when in fact Cloud HSM is just a protection level option within KMS and not a separate service needed for the stated requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Audit Logs
Cloud KMS (E) is correct because it provides Customer-Managed Encryption Keys (CMEK) that can be configured with a 30-day rotation schedule, satisfying the key rotation requirement for data at rest. Cloud Storage (D) is correct because it is the service holding the data and supports CMEK encryption, allowing objects to be encrypted with keys managed in Cloud KMS. Cloud Audit Logs (B) is correct because it records Admin Activity and Data Access audit logs for Cloud KMS, enabling the organization to audit who accessed keys and when. Cloud HSM (A) is not required here since the scenario asks for key rotation and auditing, not hardware-backed key protection, and Cloud HSM is a key protection level rather than a separate auditing or rotation service. Secret Manager (C) is not appropriate because it stores secrets such as API keys and passwords, not encryption keys for Cloud Storage data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud HSM
Why it's wrong here
Cloud HSM provides hardware-backed keys for enhanced cryptographic security, but it is not a prerequisite for key rotation. Cloud KMS can automatically rotate software-generated keys without an HSM, so the absence of an HSM does not hinder key lifecycle management. Moreover, an HSM alone does not address the requirement to track key usage, which is the primary goal here.
- ✓
Cloud Audit Logs
Why this is correct
Cloud Audit Logs records both admin activity and data access events, including every call to decrypt data with a Cloud KMS key. By enabling Data Access audit logs for Cloud KMS, the organization gains a detailed trail of who accessed which key, when, and from what context, enabling anomaly detection and compliance audits. This visibility is essential for verifying that key rotation policies are enforced and that keys are not misused.
- ✗
Secret Manager
Why it's wrong here
Secret Manager is purpose-built for storing application secrets like passwords, API tokens, and database credentials, not for managing customer-managed encryption keys. While it can store arbitrary sensitive strings, it lacks the cryptographic key versioning and rotation APIs that Cloud KMS provides for integrated encryption with Cloud Storage. Therefore, it is the wrong service for the key rotation requirement.
- ✓
Cloud Storage
Why this is correct
Cloud Storage is the service that stores the encrypted objects at rest; when CMEK is enabled, data is encrypted with a key managed by Cloud KMS before being written to buckets. Cloud Storage does not manage or rotate encryption keys itself—it simply uses the specified key to encrypt and decrypt blobs. Thus, it is a necessary component but not the solution for key lifecycle management.
- ✓
Cloud KMS
Why this is correct
Cloud KMS is the central service that manages cryptographic keys and supports automatic rotation by creating new key versions on a defined schedule. It integrates with Cloud Storage via CMEK, ensuring that new data is encrypted with the latest key version while old data remains decryptable with prior versions. This allows the organization to enforce rotation policies without manual re-encryption, meeting the key management requirement.
Go deeper
Related to this question
Learn chapter
Google Maps Platform for Location Services
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
Courseiva writes every GCDL question from scratch — 848 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.