- A
Re-enable the disabled key version in Cloud KMS so that objects can be read with the old key.
Why wrong: Re-enabling a disabled key violates the key rotation policy and does not meet the requirement for current key encryption.
- B
Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.
This command rewrites the object using the bucket's current KMS key, effectively re-encrypting it without changing other properties.
- C
Enable object versioning on the bucket and delete the non-compliant object versions.
Why wrong: Versioning does not re-encrypt objects; deleting old versions removes them but the remaining objects are still encrypted with the old key.
- D
Create a new bucket with default encryption set to the current key and copy objects to it.
Why wrong: Copying to a new bucket will re-encrypt with the new key, but this approach is less efficient and changes the bucket name and path, potentially breaking dependencies. The correct action is to rewrite in place.
Quick Answer
The answer is to use the `gsutil rewrite -k` command to re-encrypt Cloud Storage objects with the current CMEK key version. This command forces a server-side rewrite of the object metadata, which triggers a new encryption operation using the active Cloud KMS key version, even if the underlying object data remains unchanged. This is necessary because Cloud Storage does not automatically re-encrypt objects when a key is rotated; only new writes use the latest version. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding of CMEK lifecycle management and the distinction between key rotation and object re-encryption. A common trap is assuming that enabling automatic key rotation on the key itself will retroactively update existing objects, which it does not. Remember the memory tip: "Rewrite to re-encrypt" — if the key version changes, you must explicitly rewrite the object to apply the new encryption.
PCSE Supporting compliance requirements Practice Question
This PCSE practice question tests your understanding of supporting compliance requirements. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a compliance policy requiring that all data at rest in Cloud Storage be encrypted with a Cloud KMS key that is rotated every 90 days. The company uses CMEK with automatic key rotation enabled. An auditor discovers that some older objects in a bucket were created with a previous key version that has since been disabled. The compliance team requires that all objects be re-encrypted with the current key version. The bucket does not have object versioning enabled. What should the security engineer do to remediate this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.
Option B is correct because the 'gsutil rewrite -k' command re-encrypts existing objects in Cloud Storage with the current Cloud KMS key version, without requiring object versioning or re-uploading. This directly addresses the compliance requirement to re-encrypt all objects with the current key version, even though the old key version is disabled.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Re-enable the disabled key version in Cloud KMS so that objects can be read with the old key.
Why it's wrong here
Re-enabling a disabled key violates the key rotation policy and does not meet the requirement for current key encryption.
- ✓
Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.
Why this is correct
This command rewrites the object using the bucket's current KMS key, effectively re-encrypting it without changing other properties.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Enable object versioning on the bucket and delete the non-compliant object versions.
Why it's wrong here
Versioning does not re-encrypt objects; deleting old versions removes them but the remaining objects are still encrypted with the old key.
- ✗
Create a new bucket with default encryption set to the current key and copy objects to it.
Why it's wrong here
Copying to a new bucket will re-encrypt with the new key, but this approach is less efficient and changes the bucket name and path, potentially breaking dependencies. The correct action is to rewrite in place.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the misconception that re-enabling a disabled key version or copying objects to a new bucket is sufficient for compliance, when in fact only a direct re-encryption operation like 'gsutil rewrite -k' ensures the objects are encrypted with the current key version.
Detailed technical explanation
How to think about this question
The 'gsutil rewrite -k' command triggers a server-side rewrite of the object, which re-encrypts it using the bucket's default KMS key (or a specified key) without downloading and re-uploading the data. This operation is atomic and does not change the object's metadata or generation number, but it ensures the object is encrypted with the latest key version. In scenarios where automatic key rotation is enabled, objects encrypted with older key versions remain readable as long as the old key version is enabled, but compliance policies often require active re-encryption to the current version.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Supporting compliance requirements — study guide chapter
Learn the concepts, then practise the questions
- →
Supporting compliance requirements practice questions
Targeted practice on this topic area only
- →
All PCSE questions
500 questions across all exam domains
- →
Google Professional Cloud Security Engineer study guide
Full concept coverage aligned to exam objectives
- →
PCSE practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PCSE practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Configuring network security practice questions
Practise PCSE questions linked to Configuring network security.
Configuring access within a cloud solution environment practice questions
Practise PCSE questions linked to Configuring access within a cloud solution environment.
Ensuring data protection practice questions
Practise PCSE questions linked to Ensuring data protection.
Managing operations in a cloud solution environment practice questions
Practise PCSE questions linked to Managing operations in a cloud solution environment.
Supporting compliance requirements practice questions
Practise PCSE questions linked to Supporting compliance requirements.
PCSE fundamentals practice questions
Practise PCSE questions linked to PCSE fundamentals.
PCSE scenario practice questions
Practise PCSE questions linked to PCSE scenario.
PCSE troubleshooting practice questions
Practise PCSE questions linked to PCSE troubleshooting.
Practice this exam
Start a free PCSE practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PCSE question test?
Supporting compliance requirements — This question tests Supporting compliance requirements — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version. — Option B is correct because the 'gsutil rewrite -k' command re-encrypts existing objects in Cloud Storage with the current Cloud KMS key version, without requiring object versioning or re-uploading. This directly addresses the compliance requirement to re-encrypt all objects with the current key version, even though the old key version is disabled.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.