PCSE Ensuring Data Protection Practice Question
A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted using keys that they manage and rotate on a schedule they control. The keys must be stored in a FIPS 140-2 Level 3 validated HSM. Which encryption approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer-Managed Encryption Keys (CMEK) with Cloud HSM
Customer-Managed Encryption Keys (CMEK) combined with Cloud HSM allow customers to manage their own keys in a FIPS 140-2 Level 3 validated HSM. Google-managed keys do not give customer control, and Customer-Supplied Encryption Keys (CSEK) require the customer to supply the key with each API call and Google does not store the key, which is impractical for many use cases and does not use HSM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud External Key Manager (Cloud EKM)
Why it's wrong here
Cloud EKM uses keys managed in an external key management system, not within Google's HSM.
- ✓
Customer-Managed Encryption Keys (CMEK) with Cloud HSM
Why this is correct
CMEK with Cloud HSM allows the customer to manage keys stored in a FIPS 140-2 Level 3 validated HSM and control rotation.
- ✗
Customer-Supplied Encryption Keys (CSEK)
Why it's wrong here
CSEK requires the customer to provide the key with each API call; Google does not store the key and does not use HSM.
- ✗
Google-managed encryption keys (GMEK)
Why it's wrong here
GMEK does not provide customer control over key management or rotation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.