Google PCA Designing for Security and Compliance Practice Question
A company is migrating its on-premises data warehouse to BigQuery. The security team requires that all data at rest in BigQuery is encrypted with keys that the company controls, and that key usage is logged for auditing. They also need to be able to revoke access to the data by disabling the key. Which configuration should they implement?
⚠ Common exam trap
The trap here is thinking BigQuery supports Customer-Supplied Encryption Keys (CSEK); it does not, and CMEK is the correct mechanism for customer-controlled keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Customer-Managed Encryption Keys (CMEK) for BigQuery, and enable Cloud KMS audit logs.
Customer-Managed Encryption Keys (CMEK) for BigQuery allow you to use your own keys in Cloud KMS to encrypt data at rest. Enabling Cloud KMS audit logs records all key usage, satisfying the auditing requirement. Disabling the key revokes access to the data. This configuration meets all security requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use BigQuery default encryption and enable Cloud Audit Logs for BigQuery.
Why it's wrong here
BigQuery default encryption uses Google-managed keys, which do not give the company control over the keys. Cloud Audit Logs will log access to BigQuery, but not key usage. Disabling a key is not possible because the keys are managed by Google. This does not meet the requirement for customer-controlled keys and key usage logging.
- ✗
Use Customer-Supplied Encryption Keys (CSEK) for BigQuery, and store the keys in a secure vault.
Why it's wrong here
BigQuery does not support CSEK. CSEK is available for Cloud Storage and Compute Engine, but not for BigQuery. Therefore, this option is not feasible. Additionally, managing keys manually would not provide automatic key usage logging or easy revocation.
- ✗
Use Cloud HSM to generate keys, and configure BigQuery to use those keys for encryption.
Why it's wrong here
Cloud HSM can be used as a backend for Cloud KMS keys, but BigQuery encryption is configured through CMEK, not directly with Cloud HSM. You would still need to create a CMEK key in Cloud KMS with Cloud HSM as the protection level. Without CMEK configuration, BigQuery will not use the Cloud HSM keys.
- ✓
Use Customer-Managed Encryption Keys (CMEK) for BigQuery, and enable Cloud KMS audit logs.
Why this is correct
CMEK allows you to use your own keys in Cloud KMS to encrypt BigQuery data. Enabling Cloud KMS audit logs records all key usage, including encryption and decryption operations. Disabling the key immediately revokes access to the data. This meets all requirements: customer-controlled keys, key usage logging, and revocation capability.
Go deeper
Related to this question
Learn chapter
IAM Policies, Service Accounts, and Auditing
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
About these practice questions
One of 807 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.