Google Professional Cloud Security Engineer Exam - Topic 2 Question 80 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 80
Topic #: 2

[All Professional Cloud Security Engineer Questions]

You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS). in project "pr j -a", and the Cloud Storage bucket will use project "prj-b". The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key. and you need to troubleshoot why.

What has caused the access issue?

AA firewall rule prevents the key from being accessible.

BCloud HSM does not support Cloud Storage

CThe CMEK is in a different project than the Cloud Storage bucket

DThe CMEK is in a different region than the Cloud Storage bucket.

Show Suggested Answer

Suggested Answer: D

When you use a customer-managed encryption key (CMEK) to secure a Cloud Storage bucket, the key and the bucket must be located in the same region. In this case, the key is in europe-west3 and the bucket is in europe-west1, which is why you're unable to access the key.

by Tyisha at May 29, 2024, 05:13 PM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Reuben

6 months ago

Sounds too simple, but I think it's the project issue.

upvoted 0 times

...

Quinn

6 months ago

No way, HSM should work with Cloud Storage!

upvoted 0 times

...

Clay

6 months ago

Wait, does the region really matter for access?

upvoted 0 times

...

Lavonda

7 months ago

Totally agree, that's a common mistake!

upvoted 0 times

...

Alease

7 months ago

The CMEK is in a different project than the Cloud Storage bucket.

upvoted 0 times

...

Doyle

7 months ago

I thought HSMs were compatible with Cloud Storage, so I'm not sure about option B. But I guess it could be a project or region issue instead.

upvoted 0 times

...

Quentin

7 months ago

I practiced a similar question where access issues were related to permissions. But here, it seems more about project separation. I lean towards option C.

upvoted 0 times

...

Dalene

7 months ago

I'm not entirely sure, but I feel like region mismatches can cause problems too. Maybe option D is worth considering?

upvoted 0 times

...

Aleta

8 months ago

I remember something about CMEK needing to be in the same project as the resource using it. So, I think option C might be the issue here.

upvoted 0 times

...

Amos

8 months ago

This seems straightforward to me. The key is in a different project than the bucket, so the bucket doesn't have the necessary permissions to access the CMEK. I'll select option C as the answer.

upvoted 0 times

...

Long

8 months ago

I'm a bit confused here. The question says the CMEK is backed by a Cloud HSM, but then it also says the Cloud HSM doesn't support Cloud Storage. I'm not sure how to reconcile those two details.

upvoted 0 times

...

Minna

8 months ago

Okay, I think I've got this. The key is in a different region than the bucket, so that's why the bucket can't access it. The question is pretty clear about the different regions.

upvoted 0 times

...

Nickolas

8 months ago

Hmm, the question mentions the CMEK is in a different project than the Cloud Storage bucket. That's probably the issue - the bucket can't access the key since it's in a different project.

upvoted 0 times

...

Julieta

8 months ago

This seems like a tricky one. I'll need to carefully review the details about the CMEK and the project setup to figure out what's causing the access issue.

upvoted 0 times

...

Georgiana

8 months ago

This looks like a straightforward TOGAF question. I'll review the TOGAF Content Framework and think about which artifact type shows relationships between things.

upvoted 0 times

...

Son

8 months ago

I remember we practiced a question about needing accounts in both Unified CM and Control Hub. That seems right for this too.

upvoted 0 times

...

Princess

8 months ago

I remember studying different types of phishing attacks and I think whaling is the term for targeting senior executives specifically. I'm almost sure of it!

upvoted 0 times

...

Larae

2 years ago

A) A firewall rule prevents the key from being accessible. Wouldn't that be just my luck? I bet the network team is laughing it up right now.

upvoted 0 times

...

Dudley

2 years ago

I bet the person setting this up was like, 'Hey, let's make this extra complicated!' C'mon, just put the key and the bucket in the same project, it's not rocket science!

upvoted 0 times

...

Youlanda

2 years ago

D) The CMEK is in a different region than the Cloud Storage bucket. Gotta make sure those are aligned, or else you're gonna have a bad time.

upvoted 0 times

Brigette

2 years ago

D) The CMEK is in a different region than the Cloud Storage bucket. Gotta make sure those are aligned, or else you're gonna have a bad time.

upvoted 0 times

...

Thad

2 years ago

C) The CMEK is in a different project than the Cloud Storage bucket

upvoted 0 times

...

Laticia

2 years ago

A) A firewall rule prevents the key from being accessible.

upvoted 0 times

...

Lavonda

2 years ago

C) The CMEK is in a different project than the Cloud Storage bucket. That's the key issue here. The projects need to match for the encryption to work properly.

upvoted 0 times

Emelda

2 years ago

D) The CMEK is in a different region than the Cloud Storage bucket.

upvoted 0 times

...

Abel

2 years ago

C) The CMEK is in a different project than the Cloud Storage bucket. That's the key issue here.

upvoted 0 times

...

Earlean

2 years ago

C) The CMEK is in a different project than the Cloud Storage bucket. That's the key issue here. The projects need to match for the encryption to work properly.

upvoted 0 times

...