Discuss Google Professional Cloud Security Engineer Exam Topic 1 Question 117

You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?

A1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project.2. Grant your Google Cloud project access to a supported external key management partner system.

B1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).2. In Cloud KMS, grant your Google Cloud project access to use the key.

C1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system.2. In the external key management partner system, grant access for this key to use your Google Cloud project.

D1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).2. In Cloud KMS, grant your Google Cloud project access to use the key.

Suggested Answer: C

https://cloud.google.com/kms/docs/ekm#how_it_works

- First, you create or use an existing key in a supported external key management partner system. This key has a unique URI or key path.

- Next, you grant your Google Cloud project access to use the key, in the external key management partner system.

- In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

24 comments · newest first

Whitley 2 days ago

D seems off. KMS isn't for external keys.

Emerson 8 days ago

C makes sense too. External systems are important for security.

Yasuko 13 days ago

I feel like B is safer. Cloud KMS is reliable.

Gail 18 days ago

I think option A is the right choice. It mentions external key management.

Sarina 23 days ago

Option D is confusing. Why use Cloud KMS for external keys? Doesn’t make sense.

Ronnie 28 days ago

I’m leaning towards option C too. External management feels safer for sensitive data.

Almeta 1 month ago

I feel like option A covers all bases. URI and access are key steps.

Golda 1 month ago

Option B seems easier, but it uses Cloud KMS. Not sure if that's the best choice.

Von 1 month ago

I prefer option C. It focuses on external systems, which is crucial for security.

Christiane 2 months ago

I think option A is the way to go. It mentions external key management.

Sherita 2 months ago

D seems off, KMS isn't for external keys.

Vinnie 2 months ago

Wait, can you really use an external key manager? That's new to me!

Lynelle 2 months ago

C sounds right, but I'm not sure about the external part.

Cassandra 2 months ago

I think B is better, KMS is more integrated.

Keith 2 months ago

Option A is the way to go!

Mary 3 months ago

Definitely A), it's the most straightforward approach!

Desirae 3 months ago

Wait, can we really trust external key management?

Annabelle 3 months ago

C) sounds correct, but I'm not sure about the external partner system.

Novella 3 months ago

I think B) is better since it uses Cloud KMS directly.

Mollie 3 months ago

A) is the right choice for external key management.

Santos 4 months ago

I’m a bit confused about whether we should use Cloud KMS or go straight to the external key management system. I need to double-check that part.

Aliza 4 months ago

I feel like option C makes sense since it mentions using an external key management partner, which is what we need for Cloud External Key Manager.

Cherrie 4 months ago

I remember practicing a similar question where we had to grant access to the project, but I can't recall if it was before or after creating the key.

Corazon 5 months ago

I think the first step involves creating a key with a unique URI, but I'm not sure if it should be in Cloud KMS or an external system.

Google Professional Cloud Security Engineer Exam - Topic 1 Question 117 Discussion