Cloud Digital Leader Google Cloud Security Practice Question
An organization wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they control and rotate periodically. They also need to audit key usage. Which approach should they take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS
Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow customers to control and rotate keys and audit usage via Cloud Audit Logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Customer-Supplied Encryption Keys (CSEK)
Why it's wrong here
Customer-Supplied Encryption Keys (CSEK) require you to provide your own key material with every API call, and Google does not persist these keys. This means you must maintain a secure store for keys and supply them each time you access data, which makes automated rotation and comprehensive audit logging impractical. If a key is lost, the data encrypted with it becomes permanently inaccessible, and there is no central key management to enforce lifecycle policies.
- ✓
Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS
Why this is correct
Customer-Managed Encryption Keys (CMEK) with Cloud KMS let you create, rotate, and disable keys directly within Google Cloud while retaining full control. Each encryption/decryption operation is logged to Cloud Audit Logs, providing detailed visibility into who used the key. You can set automatic rotation periods and restrict key usage via IAM, making it the natural choice to enforce the organization's data governance requirements.
- ✗
Use default Google-managed encryption keys
Why it's wrong here
Default Google-managed encryption causes Google Cloud to encrypt all data at rest using keys entirely owned and managed by Google. While this provides strong baseline security, you have no ability to control key rotation, monitor key usage, or enforce your own cryptographic policies. As a result, it cannot meet the organization's need to enforce its own encryption standards or demonstrate auditability of key access.
- ✗
Use Cloud External Key Manager (Cloud EKM)
Why it's wrong here
Cloud External Key Manager (Cloud EKM) lets you manage encryption keys in an external key management provider outside Google Cloud, which can satisfy regulatory demands for geographic or organizational separation. However, it requires setting up and maintaining secure network connectivity to the external service, and each key operation involves additional latency and complexity. For an organization simply wanting integrated rotation and audit without that extra infrastructure, CMEK is the more straightforward and preferred solution.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Cloud Audit Logs
Cloud Audit Logs are a record of actions taken by users, services, and resources inside a cloud environment, capturing who did what, when, and from where.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.