PCSE Ensuring Data Protection Practice Question
A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?
⚠ Common exam trap
Google often tests the distinction between CMEK and CSEK, where candidates mistakenly choose CSEK because they think 'customer-supplied' implies full control, but they overlook that CSEK does not support persistent key management or rotation, which is a core requirement in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer-managed encryption keys (CMEK) using Cloud KMS
Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer-supplied encryption keys (CSEK)
Why it's wrong here
CSEK requires supplying keys per API call; rotation is not centrally managed.
- ✗
Google-managed encryption (GMEK)
Why it's wrong here
GMEK uses keys managed by Google, not the customer.
- ✓
Customer-managed encryption keys (CMEK) using Cloud KMS
Why this is correct
CMEK allows customers to manage and rotate their keys via Cloud KMS.
- ✗
Cloud HSM
Why it's wrong here
Cloud HSM is a hardware security module; it is used with CMEK or CSEK, not an encryption option by itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.