mediumMultiple SelectObjective-mapped
PCDE Practice Question: A team wants to enforce that all Compute Engine…
A team wants to enforce that all Compute Engine disks must be encrypted with Customer-Managed Encryption Keys (CMEK) stored in Cloud Key Management Service (KMS). Which TWO steps should they take? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse the IAM role required for the Compute Engine service account (which is the Compute Engine Service Agent, not the default compute service account) and mistakenly think enabling the Cloud KMS API is a step to enforce the policy rather than a prerequisite for using CMEK keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an organization policy 'constraints/compute.requireCmek' at the desired level.
The organization policy constraint 'constraints/compute.requireCmek' enforces that all new Compute Engine disks in the specified hierarchy must be encrypted with a Customer-Managed Encryption Key (CMEK) from Cloud KMS. This policy prevents the creation of unencrypted disks or disks encrypted with Google-managed keys, ensuring compliance with security requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply an organization policy 'constraints/compute.requireCmek' at the desired level.
Why this is correct
This policy enforces that all disks use CMEK.
- ✓
Create a KMS key ring and key in the same region as the disks.
Why this is correct
The key must exist and be accessible to the Compute Engine service account.
- ✗
Use gcloud commands to encrypt all existing disks with the KMS key.
Why it's wrong here
Existing disks must be manually encrypted, but the question asks for steps to enforce the policy, which is preventive.
- ✗
Enable the Cloud KMS API in each project where the policy is enforced.
Why it's wrong here
The KMS API is needed for key management, but the policy already requires CMEK; enabling the API is a prerequisite but not a step to enforce the policy.
- ✗
Grant the cloudkms.cryptoKeyEncrypterDecrypter role to the Compute Engine service account.
Why it's wrong here
This role is needed for the service account to use the key, but it is not a step to enforce the policy; it's a permission that must be granted separately.
Go deeper
Related to this question
About these practice questions
One of 1,446 original PCDE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCDE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Arrange the steps to set up database encryption with Cloud KMS for Cloud SQL.
medium- ✓ A.1. Create KMS key ring and key. 2. Grant Cloud SQL service account access to the KMS key. 3. Create Cloud SQL instance with CMEK. 4. Verify encryption and test.
- B.1. Grant Cloud SQL service account access to the KMS key. 2. Create KMS key ring and key. 3. Create Cloud SQL instance with CMEK. 4. Verify encryption and test.
- C.1. Create Cloud SQL instance with CMEK. 2. Create KMS key ring and key. 3. Grant Cloud SQL service account access to the KMS key. 4. Verify encryption and test.
- D.1. Create KMS key ring and key. 2. Create Cloud SQL instance with CMEK. 3. Grant Cloud SQL service account access to the KMS key. 4. Verify encryption and test.
Why A: First create KMS key, grant access, then create instance with CMEK, verify, test.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDE exam.