Google PCA Designing for Security and Compliance Practice Question
A company wants to use Cloud Key Management Service (Cloud KMS) to manage encryption keys for multiple applications. They have the following requirements: 1) Keys must be automatically rotated every 90 days. 2) Different applications should have access only to their own keys. 3) All key operations must be logged for audit purposes. Which THREE steps should they take? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Cloud Audit Logs for the Cloud KMS API
Cloud KMS supports key rotation schedules, IAM for access control, and Cloud Audit Logs for logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the roles/cloudkms.admin role to each application's service account
Why it's wrong here
Admin role allows management of keys, which is too permissive. Use roles/cloudkms.cryptoKeyEncrypterDecrypter instead.
- ✓
Enable Cloud Audit Logs for the Cloud KMS API
Why this is correct
Audit logs capture all key operations for compliance.
- ✗
Store the keys in Cloud HSM
Why it's wrong here
HSM is not required for all applications; the requirement does not specify HSM.
- ✓
Create a key ring for each application
Why this is correct
Organizing keys into separate key rings per application helps isolate access via IAM policies.
- ✓
Set a rotation period of 90 days on each key
Why this is correct
Cloud KMS allows setting a rotation period; the key will be automatically rotated.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
Key term
KMS
KMS (Key Management Service) is a Microsoft technology that automates volume licensing activation for Windows and Office products within an organization's network.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.