The correct solution is Cloud External Key Manager (Cloud EKM) to reference on-premises HSM keys for Cloud Storage. This works because Cloud EKM integrates with supported third-party partners, allowing you to keep your key material securely inside your on-premises hardware security module while Google Cloud uses those keys for encryption operations via a secure, external key reference. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding of key sovereignty and the distinction between Google-managed, customer-managed, and external key options—a common trap is choosing Cloud KMS with CMEK, which still stores key material in Google Cloud, failing the regulatory requirement. Remember that Cloud EKM is the only native solution that keeps keys entirely off Google’s infrastructure while still enabling Cloud Storage encryption. Memory tip: “EKM = External Key Mastery” for on-premises compliance.
PCSE Ensuring data protection Practice Question
This PCSE practice question tests your understanding of ensuring data protection. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.
Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use Cloud HSM to create and manage keys.
Why it's wrong here
Cloud HSM is a Google-managed HSM, not on-premises.
✓
Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.
Why this is correct
Cloud EKM allows using externally managed keys for Cloud Storage.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use customer-supplied encryption keys (CSEK) for each object.
Why it's wrong here
CSEK is not practical for large-scale migration and does not integrate with on-premises HSM.
✗
Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.
Why it's wrong here
Keys are managed by Google, not on-premises.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the distinction between where the key is created versus where it is stored and managed; the trap here is assuming Cloud HSM (which is hardware-backed) meets the 'on-premises HSM' requirement, when in fact it is a Google-managed service in Google's infrastructure.
Detailed technical explanation
How to think about this question
Cloud EKM uses a partner integration (e.g., with Fortanix, Thales, or Equinix) to expose an external key via a RESTful API that Google Cloud services call for encryption/decryption. The key never leaves your HSM; instead, Cloud EKM sends the ciphertext to the external service, which performs the cryptographic operation and returns the result. This ensures compliance with regulations like PCI-DSS or GDPR that mandate key material remain in a physically controlled environment.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Ensuring data protection — This question tests Ensuring data protection — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM. — Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.