mediumMultiple ChoiceObjective-mapped
PCSE Migrating on-premises data to Cloud Storage Practice Question
A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?
⚠ Common exam trap
Google Cloud often tests the distinction between where the key is created versus where it is stored and managed; the trap here is assuming Cloud HSM (which is hardware-backed) meets the 'on-premises HSM' requirement, when in fact it is a Google-managed service in Google's infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.
Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud HSM to create and manage keys.
Why it's wrong here
Cloud HSM is a Google-managed HSM, not on-premises.
- ✓
Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.
Why this is correct
Cloud EKM allows using externally managed keys for Cloud Storage.
- ✗
Use customer-supplied encryption keys (CSEK) for each object.
Why it's wrong here
CSEK is not practical for large-scale migration and does not integrate with on-premises HSM.
- ✗
Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.
Why it's wrong here
Keys are managed by Google, not on-premises.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.