The answer is Customer-Supplied Encryption Keys (CSEK). This is correct because CSEK allows you to provide your own encryption keys that Google uses only transiently during encryption and decryption operations, then immediately discards—meaning Google never stores the keys on its servers and therefore cannot access your data. This directly satisfies the requirement that only users with explicit IAM permissions can decrypt the data, since access to the CSEK key itself is controlled through IAM roles like Storage Object Viewer. On the Google Professional Cloud Security Engineer exam, this question tests your ability to distinguish CSEK from CMEK: the common trap is choosing CMEK, but remember that CMEK keys are stored and managed by Cloud KMS, so Google still has logical access to the key material. CSEK is the only option where Google truly has no key access. Memory tip: “CSEK = Customer Supplies, Google Evaporates the Key.”
PCSE Ensuring data protection Practice Question
This PCSE practice question tests your understanding of ensuring data protection. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company stores sensitive customer data in Cloud Storage. They want to ensure that only users with explicit IAM permissions can decrypt the data, and that Google does not have access to the encryption keys. Which encryption option should they use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer-supplied encryption keys (CSEK)
Customer-supplied encryption keys (CSEK) allow you to provide your own encryption keys, which are used to protect data at rest in Cloud Storage. Google does not store these keys on its servers; they are used only transiently during encryption/decryption operations and then discarded, ensuring that Google cannot access the keys or the decrypted data. This meets the requirement that only users with explicit IAM permissions can decrypt the data, as access to the CSEK must be granted through IAM roles like Storage Object Viewer with the CSEK key.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Customer-managed encryption keys (CMEK)
Why it's wrong here
CMEK keys are stored in Cloud KMS, so Google has access to the key material.
✗
Google-managed encryption keys (GMEK)
Why it's wrong here
Google manages these keys and has access to them.
✗
Default encryption
Why it's wrong here
Default encryption uses Google-managed keys.
✓
Customer-supplied encryption keys (CSEK)
Why this is correct
CSEK keys are not stored by Google; the customer supplies their own keys, and Google does not have access to them.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the distinction between CMEK and CSEK, where candidates confuse 'customer-managed' (CMEK, stored in KMS) with 'customer-supplied' (CSEK, not stored by Google), leading them to incorrectly choose CMEK when the requirement is that Google has no access to the keys.
Detailed technical explanation
How to think about this question
CSEK works by requiring the client to supply a raw AES-256 key (32 bytes) with each API request to Cloud Storage. The key is used server-side to encrypt or decrypt the object, and it is not stored persistently; only a SHA-256 hash of the key is stored for validation. This means if the key is lost, the data is irrecoverable, and key rotation requires re-encrypting all objects with a new key.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Ensuring data protection — This question tests Ensuring data protection — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Customer-supplied encryption keys (CSEK) — Customer-supplied encryption keys (CSEK) allow you to provide your own encryption keys, which are used to protect data at rest in Cloud Storage. Google does not store these keys on its servers; they are used only transiently during encryption/decryption operations and then discarded, ensuring that Google cannot access the keys or the decrypted data. This meets the requirement that only users with explicit IAM permissions can decrypt the data, as access to the CSEK must be granted through IAM roles like Storage Object Viewer with the CSEK key.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.