Quick Answer
The answer is Customer-Managed Encryption Keys (CMEK) and Customer-Supplied Encryption Keys (CSEK). CMEK allows you to manage your own key material via Cloud Key Management Service, giving you control over key rotation and lifecycle, while CSEK lets you supply your own encryption keys directly with each API call, ensuring Google never stores the key on its servers. On the Google Professional Cloud Security Engineer exam, this distinction tests your understanding of data-at-rest encryption options in Cloud Storage, often appearing as a multi-select question where CSEK is the trap for those who forget it is a supply-your-own model. A common memory tip is to associate CMEK with "managed" control and CSEK with "supplied" per-request keys—think of CSEK as bringing your own key to the door each time, while CMEK is like handing over a key you still own and manage.
This PCSE practice question tests your understanding of ensuring data protection. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which two Cloud Storage encryption options allow the customer to supply or manage the encryption keys? (Choose two.)
Default encryption at rest
Why wrong: Default is Google-managed.
Google-managed encryption keys
Why wrong: Google manages keys, no customer control.
Cloud HSM keys
Why wrong: Cloud HSM is a key storage service, not an independent encryption option.
Customer-Supplied Encryption Keys (CSEK)
Customer supplies the key material directly.
Customer-Managed Encryption Keys (CMEK)
Customer manages keys via Cloud KMS.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Customer-Supplied Encryption Keys (CSEK)
Customer-Supplied Encryption Keys (CSEK) allow you to supply your own encryption keys for protecting data at rest in Cloud Storage. With CSEK, you provide the key material for each API call, and Google does not store the key on its servers. This option is correct because the customer directly supplies the encryption key.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Default encryption at rest
Why it's wrong here
Default is Google-managed.
Google-managed encryption keys
Why it's wrong here
Google manages keys, no customer control.
Cloud HSM keys
Why it's wrong here
Cloud HSM is a key storage service, not an independent encryption option.
Customer-Supplied Encryption Keys (CSEK)
Why this is correct
Customer supplies the key material directly.
Related concept
Read the scenario before looking for a memorised answer.
Customer-Managed Encryption Keys (CMEK)
Why this is correct
Customer manages keys via Cloud KMS.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Google Cloud often tests the distinction between 'supplying' the key (CSEK) versus 'managing' a key that Google generates (CMEK), causing candidates to mistakenly think Cloud HSM keys (which are a CMEK implementation) count as customer-supplied.
Detailed technical explanation
CSEK uses AES-256 keys that you generate and provide per-object via the x-goog-encryption-key header in REST requests or the analogous gsutil flag. CMEK, on the other hand, leverages Cloud Key Management Service (KMS) where you create and manage key rings and crypto keys, but the actual key material is generated and stored by Google within Cloud KMS. A subtle behavior: if you lose a CSEK key, the associated object becomes permanently inaccessible, as Google does not retain any copy of the key.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Ensuring data protection — study guide chapter
Learn the concepts, then practise the questions
Ensuring data protection practice questions
Targeted practice on this topic area only
All PCSE questions
500 questions across all exam domains
Google Professional Cloud Security Engineer study guide
Full concept coverage aligned to exam objectives
PCSE practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PCSE questions linked to Configuring network security.
Practise PCSE questions linked to Configuring access within a cloud solution environment.
Practise PCSE questions linked to Ensuring data protection.
Practise PCSE questions linked to Managing operations in a cloud solution environment.
Practise PCSE questions linked to Supporting compliance requirements.
Practise PCSE questions linked to PCSE fundamentals.
Practise PCSE questions linked to PCSE scenario.
Practise PCSE questions linked to PCSE troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Ensuring data protection — This question tests Ensuring data protection — Read the scenario before looking for a memorised answer..
The correct answer is: Customer-Supplied Encryption Keys (CSEK) — Customer-Supplied Encryption Keys (CSEK) allow you to supply your own encryption keys for protecting data at rest in Cloud Storage. With CSEK, you provide the key material for each API call, and Google does not store the key on its servers. This option is correct because the customer directly supplies the encryption key.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: Jun 30, 2026
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.