PCSE Ensuring Data Protection Practice Question

A company wants to use Cloud KMS to encrypt data in Cloud Storage with a key that is automatically rotated every 30 days. They also want to ensure that the key material is stored in a HSM. Which TWO resources must they create? (Choose two.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A Cloud HSM key ring

To use CMEK with Cloud HSM, the engineer needs to create a Cloud HSM key ring (which is a resource that groups keys) and a cryptographic key with protection level HSM. The key ring is created first, then the key is created within it. The other options: a key ring with software protection level would not use HSM; a Cloud KMS key is created within a key ring, so both are needed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
A Cloud HSM key ring
Why this is correct
The key ring groups keys and can be created with HSM protection level.
✗
A key with purpose EXTERNAL
Why it's wrong here
EXTERNAL keys are for keys managed outside Google Cloud.
✗
A key ring with protection level software
Why it's wrong here
Software protection level does not use HSM.
✓
A cryptographic key with protection level HSM
Why this is correct
The key must have protection level HSM to be stored in the HSM.
✗
A Cloud HSM cluster
Why it's wrong here
Cloud HSM is a managed service; you don't create clusters.

Go deeper

PCSE Ensuring Data Protection Practice Question

Why each option matters

Option-by-option breakdown

Related to this question