MENU
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS). in project "pr j -a", and the Cloud Storage bucket will use project "prj-b". The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key. and you need to troubleshoot why.
What has caused the access issue?
Suggested Answer: D
Get Premium Professional Cloud Security Engineer Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
When you use a customer-managed encryption key (CMEK) to secure a Cloud Storage bucket, the key and the bucket must be located in the same region. In this case, the key is in europe-west3 and the bucket is in europe-west1, which is why you're unable to access the key.
33 comments · newest first
RE
Reuben
11 months ago
Sounds too simple, but I think it's the project issue.
QU
Quinn
11 months ago
No way, HSM should work with Cloud Storage!
CL
Clay
11 months ago
Wait, does the region really matter for access?
LA
Lavonda
11 months ago
Totally agree, that's a common mistake!
AL
Alease
12 months ago
The CMEK is in a different project than the Cloud Storage bucket.
DO
Doyle
12 months ago
I thought HSMs were compatible with Cloud Storage, so I'm not sure about option B. But I guess it could be a project or region issue instead.
QU
Quentin
1 year ago
I practiced a similar question where access issues were related to permissions. But here, it seems more about project separation. I lean towards option C.
DA
Dalene
1 year ago
I'm not entirely sure, but I feel like region mismatches can cause problems too. Maybe option D is worth considering?
AL
Aleta
1 year ago
I remember something about CMEK needing to be in the same project as the resource using it. So, I think option C might be the issue here.
AM
Amos
1 year ago
This seems straightforward to me. The key is in a different project than the bucket, so the bucket doesn't have the necessary permissions to access the CMEK. I'll select option C as the answer.
LO
Long
1 year ago
I'm a bit confused here. The question says the CMEK is backed by a Cloud HSM, but then it also says the Cloud HSM doesn't support Cloud Storage. I'm not sure how to reconcile those two details.
MI
Minna
1 year ago
Okay, I think I've got this. The key is in a different region than the bucket, so that's why the bucket can't access it. The question is pretty clear about the different regions.
NI
Nickolas
1 year ago
Hmm, the question mentions the CMEK is in a different project than the Cloud Storage bucket. That's probably the issue - the bucket can't access the key since it's in a different project.
JU
Julieta
1 year ago
This seems like a tricky one. I'll need to carefully review the details about the CMEK and the project setup to figure out what's causing the access issue.
GE
Georgiana
1 year ago
This looks like a straightforward TOGAF question. I'll review the TOGAF Content Framework and think about which artifact type shows relationships between things.
SO
Son
1 year ago
I remember we practiced a question about needing accounts in both Unified CM and Control Hub. That seems right for this too.
PR
Princess
1 year ago
I remember studying different types of phishing attacks and I think whaling is the term for targeting senior executives specifically. I'm almost sure of it!
LA
Larae
2 years ago
A) A firewall rule prevents the key from being accessible. Wouldn't that be just my luck? I bet the network team is laughing it up right now.
DU
Dudley
2 years ago
I bet the person setting this up was like, 'Hey, let's make this extra complicated!' C'mon, just put the key and the bucket in the same project, it's not rocket science!
YO
Youlanda
2 years ago
D) The CMEK is in a different region than the Cloud Storage bucket. Gotta make sure those are aligned, or else you're gonna have a bad time.
BR
Brigette
2 years ago
D) The CMEK is in a different region than the Cloud Storage bucket. Gotta make sure those are aligned, or else you're gonna have a bad time.
TH
Thad
2 years ago
C) The CMEK is in a different project than the Cloud Storage bucket
LA
Laticia
2 years ago
A) A firewall rule prevents the key from being accessible.
LA
Lavonda
2 years ago
C) The CMEK is in a different project than the Cloud Storage bucket. That's the key issue here. The projects need to match for the encryption to work properly.
EM
Emelda
2 years ago
D) The CMEK is in a different region than the Cloud Storage bucket.
AB
Abel
2 years ago
C) The CMEK is in a different project than the Cloud Storage bucket. That's the key issue here.
EA
Earlean
2 years ago
C) The CMEK is in a different project than the Cloud Storage bucket. That's the key issue here. The projects need to match for the encryption to work properly.
SU
Susy
2 years ago
A) A firewall rule prevents the key from being accessible.
GI
Giovanna
2 years ago
C
AR
Artie
2 years ago
C
ME
Merilyn
2 years ago
A) A firewall rule prevents the key from being accessible.
PA
Paris
2 years ago
I agree with Vincent. The key needs to be in the same project as the bucket for access.
VI
Vincent
2 years ago
I think the issue is that the CMEK is in a different project than the Cloud Storage bucket.