PCSE Ensuring Data Protection Practice Question
A security engineer wants to encrypt data at rest in Cloud Storage using a key that Google manages but the customer can control the key material. They need to rotate the key automatically every 90 days. Which encryption option should they choose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer-Managed Encryption Keys (CMEK) via Cloud KMS
Customer-Managed Encryption Keys (CMEK) using Cloud KMS allow customers to manage their own key material and configure automatic rotation (minimum 24h, but typically set to 90 days). GMEK is Google-managed (no customer control), CSEK requires customer to supply key with each API call (Google never stores it), and Cloud HSM is a key management service but still uses CMEK integration for rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Google default encryption (GMEK)
Why it's wrong here
GMEK is fully managed by Google; no customer control over key material or rotation.
- ✗
Customer-Supplied Encryption Keys (CSEK)
Why it's wrong here
CSEK requires you to provide the key with each API call; Google never stores the key and cannot rotate it automatically.
- ✓
Customer-Managed Encryption Keys (CMEK) via Cloud KMS
Why this is correct
CMEK lets you control key material in Cloud KMS and set automatic rotation (e.g., every 90 days).
- ✗
Cloud HSM
Why it's wrong here
Cloud HSM provides hardware-backed keys but still uses CMEK integration; the key rotation is managed via Cloud KMS, but HSM itself is not an encryption option for Storage.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.