Google PCA Designing for Security and Compliance Practice Question
A company wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they manage and rotate quarterly. They also want to ensure that the key is stored in a hardware security module (HSM). Which combination of services should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud KMS with a key backed by Cloud HSM, and set the bucket's default encryption to use that key (CMEK)
Cloud HSM provides HSM-backed keys, and Cloud KMS allows you to create and manage those keys. CMEK (Customer-Managed Encryption Keys) with Cloud KMS (backed by HSM) meets the requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer-Supplied Encryption Keys (CSEK) with Cloud Storage
Why it's wrong here
CSEK requires you to supply the key each time, and it's not stored in HSM.
- ✓
Cloud KMS with a key backed by Cloud HSM, and set the bucket's default encryption to use that key (CMEK)
Why this is correct
Cloud KMS with HSM key provides customer-managed, HSM-backed encryption keys for Cloud Storage.
- ✗
Cloud External Key Manager (Cloud EKM)
Why it's wrong here
Cloud EKM uses an external key management system, not Cloud HSM.
- ✗
Cloud HSM with default Google-managed keys
Why it's wrong here
Default Google-managed keys are not customer-managed; the company wants to manage the keys.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Hardware security module
A specialized hardware appliance that securely generates, stores, and manages cryptographic keys in a tamper-resistant environment for enterprise security systems.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.