PCSE Ensuring Data Protection Practice Question
A company uses CMEK with Cloud HSM to encrypt a BigQuery table. The security engineer accidentally deleted the key in Cloud KMS. The key is now in a 'pending destruction' state with a grace period of 24 hours. Which action should the engineer take to restore the key and avoid data loss?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore the key by canceling the destruction within the grace period
When a key is destroyed, it enters a pending destruction state for a default 24-hour grace period. During this period, the key can be restored by cancelling the destruction. After the grace period, the key is permanently destroyed and data encrypted with it becomes inaccessible. The restore operation is available in Cloud KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recreate the key with the same name and version
Why it's wrong here
Recreating a key with the same name does not restore the original key material; data encrypted with the old key would be inaccessible.
- ✗
Wait for the grace period to expire and then use a backup key
Why it's wrong here
Waiting will permanently destroy the key, leading to data loss. No backup key is available if the key was the only one.
- ✗
Use Access Transparency logs to recover the key material
Why it's wrong here
Access Transparency logs record admin access, not key material recovery.
- ✓
Restore the key by canceling the destruction within the grace period
Why this is correct
During the pending destruction state, the key can be restored by cancelling the destruction via Cloud KMS.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.