Cloud Digital Leader Google Cloud Security Practice Question
An organization wants to ensure that all data stored in Cloud Storage is encrypted with customer-managed keys that can be rotated on demand. They also need to log every key use for audit compliance. Which combination of services should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud KMS with Customer-Managed Encryption Keys (CMEK) and Cloud Audit Logs
Cloud KMS allows creation and management of customer-managed encryption keys (CMEK) for Cloud Storage. Cloud Audit Logs can be used to log key usage (e.g., via Data Access audit logs). CSEK is deprecated; Secret Manager is for secrets, not encryption keys for storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud KMS with Customer-Supplied Encryption Keys (CSEK)
Why it's wrong here
CSEK is a deprecated legacy mechanism where you supply raw encryption key material directly to Cloud Storage or Compute Engine, and Google does not persistently store your key. This forces you to manage the entire key lifecycle manually, including rotation and revocation, and because these keys are not represented in Cloud KMS, you cannot centrally audit their usage with Cloud Audit Logs for a complete compliance trail.
- ✗
Google-managed encryption keys with Access Transparency
Why it's wrong here
With Google-managed keys, the key hierarchy is fully owned by Google, so customers cannot rotate, disable, or view key material, and there is no cloud-native control plane to administer the keys. Adding Access Transparency only provides an audit trail of Google staff actions on your data; it does not provide any cryptographic control or key-usage logging from the customer's perspective, so it cannot satisfy a requirement for customer-controlled encryption keys.
- ✓
Cloud KMS with Customer-Managed Encryption Keys (CMEK) and Cloud Audit Logs
Why this is correct
CMEK allows you to create and manage key material in Cloud KMS and assign it as the key that encrypts Cloud Storage objects through a key ring and CryptoKey. You retain lifecycle control—enabling, disabling, rotating, or destroying the key—and every encryption or decryption operation under that key is recorded as a Cloud KMS operation in Cloud Audit Logs, giving you the auditability needed for security monitoring and forensic investigation.
- ✗
Secret Manager with encryption keys and Cloud Logging
Why it's wrong here
Secret Manager is a repository for sensitive values such as API keys, OAuth tokens, and database passwords; it is not a key-management service for controlling how Cloud Storage encrypts data, and it cannot generate or rotate key material used by Cloud Storage's encryption layer. Pairing it with Cloud Logging only records access to secrets—it does not produce the cryptographic key lifecycle events or data-encryption audit logs that CMEK with Cloud Audit Logs provides, so it is architecturally the wrong tool for this requirement.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
KMS
KMS (Key Management Service) is a Microsoft technology that automates volume licensing activation for Windows and Office products within an organization's network.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.