PCSE Ensuring Data Protection Practice Question
A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that the key's destruction policy does not automatically destroy versions before 6 months
To meet the requirements: 1) Set rotation period to 30 days on the key; 2) Do not destroy old key versions until after 6 months; 3) The default destruction policy does not automatically destroy old versions, so they remain available. Setting a primary version is not required for rotation, and disabling rotation is contrary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure that the key's destruction policy does not automatically destroy versions before 6 months
Why this is correct
By default, old versions are not destroyed; they remain available.
- ✗
Manually rotate the key every 30 days using a Cloud Function
Why it's wrong here
Manual rotation via a Cloud Function introduces human latency and potential for missed rotations, failing the requirement for automatic 30-day rotation. This approach is tempting because Cloud Functions can automate arbitrary tasks, and in scenarios where key rotation must be triggered by external events or custom business logic rather than a scheduled policy, a function-based solution would be correct. However, Cloud KMS’s built-in rotation policy directly enforces the schedule without operational overhead.
- ✓
Set the rotation period to 30 days on the cryptographic key
Why this is correct
This enables automatic rotation every 30 days.
- ✓
Keep the previous key versions and not schedule their destruction
Why this is correct
This ensures they are available for decryption.
- ✗
Configure the key's `next_rotation_time` to start rotation immediately
Why it's wrong here
Setting rotation period already schedules rotation; next_rotation_time is not needed.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.