Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company is moving a regulated workload to Google Cloud and must ensure that their encryption keys are stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3 validation. Which Google Cloud key management option satisfies this requirement?
⚠ Common exam trap
Many exam-takers confuse Cloud KMS software-backed keys (which are FIPS 140-2 Level 1) with Cloud HSM (Level 3), or they assume that any Google-managed key service automatically meets high-level FIPS validation, ignoring the specific Level 3 requirement for hardware-based protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules
Cloud HSM is the correct choice because it provides a dedicated HSM service that stores and manages encryption keys in FIPS 140-2 Level 3 validated hardware security modules. This directly meets the regulatory requirement for a hardware security module with that specific validation level, as opposed to software-backed or customer-supplied key options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud KMS software-backed keys, which are managed by Google and stored in Google's secure key management infrastructure
Why it's wrong here
Cloud KMS software-backed keys meet FIPS 140-2 Level 1/2 but not Level 3. Software-backed keys are protected by Google's infrastructure but not stored in dedicated FIPS 140-2 Level 3 hardware. The requirement is specifically for HSM-backed storage.
- ✗
Customer-supplied encryption keys (CSEK), where the customer provides the key with each API request
Why it's wrong here
CSEK allows customers to supply their own keys per-request, but these keys are provided to Google's software encryption layer, not stored in or managed by an HSM. The key management and HSM storage requirement is not met.
- ✓
Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules
Why this is correct
Cloud HSM specifically addresses the FIPS 140-2 Level 3 requirement. Keys generated and stored in Cloud HSM never leave the HSM in plaintext form, and all cryptographic operations occur within the certified hardware. This is the correct answer for workloads requiring hardware-backed key storage at the highest FIPS level.
- ✗
Secret Manager, which stores API keys and credentials with automatic rotation
Why it's wrong here
Secret Manager is a logical vault for storing sensitive artifacts such as API keys, database credentials, and TLS certificates, with features like versioning, IAM-based access control, and automatic rotation of secrets. However, it is not a cryptographic keystore: it does not provide FIPS 140-2 Level 3 validated hardware to generate or use keys, and its at-rest encryption is managed by Google which does not meet the requirement. Because the compliance need explicitly demands keys to be stored and operated inside a Level 3 HSM, Secret Manager cannot fulfill this role regardless of how securely it stores the secrets.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Hardware security module
A specialized hardware appliance that securely generates, stores, and manages cryptographic keys in a tamper-resistant environment for enterprise security systems.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.