Cloud Digital Leader Trust and security with Google Cloud Practice Question
Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?
⚠ Common exam trap
A common mix-up: candidates assume encryption requires explicit action (like enabling a setting or purchasing an add-on) because many cloud providers or on-premises systems require manual configuration, but Google Cloud encrypts all data at rest by default with no customer effort.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.
Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.
Why it's wrong here
Cloud Storage bucket configuration does not include an 'enable encryption' setting; encryption is applied transparently and always. When an object is uploaded, Google encrypts it at the storage layer using AES-256 before persisting it, regardless of bucket-level settings. Therefore, any claim that the customer must per-bucket enable encryption conflates optional features like CMEK with the default encryption that is universally present.
- ✓
No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.
Why this is correct
Google Cloud automatically encrypts all data at rest using AES-256, and this is enabled by default for every service, including Cloud Storage. No configuration, bucket settings, or key provision steps are needed to activate encryption. If a customer wants more control, they can optionally use Cloud KMS with CMEK or CSEK, but that enhances key management rather than providing encryption, which already exists.
- ✗
Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.
Why it's wrong here
Encryption at rest is a uniform platform capability applied to every Cloud Storage storage class—Standard, Nearline, Coldline, and Archive—without any customer action. There is no 'premium tier' that gets additional default encryption, and Standard storage does not require manual configuration. Google automatically encrypts all object data using AES-256 before it is written to disk.
- ✗
Customers must purchase the Security Command Center Premium tier to enable data encryption.
Why it's wrong here
Security Command Center is a vulnerability monitoring and security analytics service, not a mechanism for enabling at-rest encryption. Data encryption in Google Cloud is a foundational feature of the platform, included in the base service at no additional charge and active on all storage services. Purchasing SCC Premium does not turn on encryption because encryption is already on; it simply provides visibility into misconfigurations and threats.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.