Google PCA Design for security and compliance Practice Question
A healthcare company stores patient records in a Cloud Storage bucket. Compliance requires that all data be encrypted with customer-managed keys, and that the company can revoke access to the data by disabling the key. They also need to audit every key usage. Which approach should they take?
⚠ Common exam trap
The trap here is assuming that Customer-Supplied Encryption Keys (CSEK) provide the same centralized management and audit capabilities as CMEK, but CSEK keys are managed externally and lack integrated audit logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS and enable Cloud Audit Logs for Cloud KMS.
Customer-Managed Encryption Keys (CMEK) in Cloud KMS allow the organization to control the encryption key lifecycle, including disabling the key to revoke access to data. Enabling Cloud Audit Logs for Cloud KMS provides an audit trail of all key operations, which is essential for compliance. This combination meets both the encryption control and auditing requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS and enable Cloud Audit Logs for Cloud KMS.
Why this is correct
CMEK allows the customer to manage keys in Cloud KMS, including disabling or destroying them to revoke access. Enabling Cloud Audit Logs for Cloud KMS records all key usage, satisfying the audit requirement. This approach meets both the encryption control and auditability needs for compliance.
- ✗
Use default Google encryption and configure a Cloud Storage retention policy.
Why it's wrong here
Default Google encryption uses Google-managed keys, which do not provide customer control over key revocation. A retention policy prevents deletion of objects for a period but does not encrypt data with customer-managed keys or allow revoking access by disabling a key. This does not satisfy the compliance requirements.
- ✗
Use Customer-Supplied Encryption Keys (CSEK) and enable Cloud Audit Logs for Cloud Storage.
Why it's wrong here
CSEK requires the customer to provide and manage the encryption keys themselves, and Google does not store them. While this gives control, it lacks integration with Cloud KMS for centralized key management and audit logging of key usage. Disabling a key is not as straightforward as with CMEK, and auditing key usage is limited because keys are external.
- ✗
Use Google-managed encryption keys (GMEK) and enable Cloud Audit Logs for Cloud Storage.
Why it's wrong here
Google-managed encryption keys are fully managed by Google and cannot be disabled or revoked by the customer, so they do not meet the requirement to revoke access by disabling a key. While audit logs can record data access, they do not provide customer control over the encryption key lifecycle. Thus this approach fails the compliance requirement for customer-managed keys.
Go deeper
Related to this question
Learn chapter
IAM Policies, Service Accounts, and Auditing
Key term
KMS
KMS (Key Management Service) is a Microsoft technology that automates volume licensing activation for Windows and Office products within an organization's network.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
One of 807 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.