Discuss Google Professional Data Engineer Exam Topic 5 Question 90

One of your encryption keys stored in Cloud Key Management Service (Cloud KMS) was exposed. You need to re-encrypt all of your CMEK-protected Cloud Storage data that used that key. and then delete the compromised key. You also want to reduce the risk of objects getting written without customer-managed encryption key (CMEK protection in the future. What should you do?

ARotate the Cloud KMS key version. Continue to use the same Cloud Storage bucket.

BCreate a new Cloud KMS key. Set the default CMEK key on the existing Cloud Storage bucket to the new one.

CCreate a new Cloud KMS key. Create a new Cloud Storage bucket. Copy all objects from the old bucket to the new one bucket while specifying the new Cloud KMS key in the copy command.

DCreate a new Cloud KMS key. Create a new Cloud Storage bucket configured to use the new key as the default CMEK key. Copy all objects from the old bucket to the new bucket without specifying a key.

Suggested Answer: C

To re-encrypt all of your CMEK-protected Cloud Storage data after a key has been exposed, and to ensure future writes are protected with a new key, creating a new Cloud KMS key and a new Cloud Storage bucket is the best approach. Here's why option C is the best choice:

Re-encryption of Data:

By creating a new Cloud Storage bucket and copying all objects from the old bucket to the new bucket while specifying the new Cloud KMS key, you ensure that all data is re-encrypted with the new key.

This process effectively re-encrypts the data, removing any dependency on the compromised key.

Ensuring CMEK Protection:

Creating a new bucket and setting the new CMEK as the default ensures that all future objects written to the bucket are automatically protected with the new key.

This reduces the risk of objects being written without CMEK protection.

Deletion of Compromised Key:

Once the data has been copied and re-encrypted, the old key can be safely deleted from Cloud KMS, eliminating the risk associated with the compromised key.

Steps to Implement:

Create a New Cloud KMS Key:

Create a new encryption key in Cloud KMS to replace the compromised key.

Create a New Cloud Storage Bucket:

Create a new Cloud Storage bucket and set the default CMEK to the new key.

Copy and Re-encrypt Data:

Use the gsutil tool to copy data from the old bucket to the new bucket while specifying the new CMEK key:

gsutil -o 'GSUtil:gs_json_api_version=2' cp -r gs://old-bucket/* gs://new-bucket/

Delete the Old Key:

After ensuring all data is copied and re-encrypted, delete the compromised key from Cloud KMS.

Cloud KMS Documentation

Cloud Storage Encryption

Re-encrypting Data in Cloud Storage

Get Premium Professional Data Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Britt 11 months ago

I agree with B, but isn't it a hassle to copy everything over?

Tomoko 11 months ago

Option D sounds risky, not specifying a key could lead to issues.

Melvin 11 months ago

Wait, why would you create a new bucket if you can just rotate the key?

Malinda 11 months ago

I think option C is better, a new bucket adds extra security.

Tresa 12 months ago

Definitely go with option B, it's the safest way to handle it.

Kimberely 12 months ago

I'm a bit confused about whether we need a new bucket at all. Option D seems to suggest we can just copy without specifying a key, but that feels risky.

Ruby 1 year ago

I practiced a similar question where we had to copy objects to a new bucket. I feel like option C might be the safest way to ensure everything is re-encrypted properly.

Shonda 1 year ago

I think creating a new Cloud KMS key and setting it as the default for the existing bucket makes sense, but I wonder if that really protects against future risks.

Azalee 1 year ago

I remember we discussed the importance of rotating keys, but I'm not sure if just rotating the key version is enough in this case.

Haydee 1 year ago

Creating a new bucket and copying the data seems like the most thorough approach to address the issue. I'll probably go with that option.

Tyra 1 year ago

I like the idea of creating a new bucket and copying the data over. That way, I can be sure the new key is being used for everything going forward.

Rosita 1 year ago

I'm a bit confused on the difference between rotating the key version and creating a new key. I'll need to review the details on those options more closely.

Mitsue 1 year ago

This seems like a tricky one. I'll need to carefully consider the options and think through the implications of each approach.

Luke 1 year ago

Okay, let's see. I think the key here is to create a new CMEK key and then re-encrypt the data using that new key. That should help reduce the risk of future exposure.

Ivette 1 year ago

This looks like a straightforward multiple-choice question about Truffle. I'm pretty confident I know the answer - Truffle is a framework for developing and deploying smart contracts, so I'll go with option A.

Cory 2 years ago

I'm with Tracey on this one. Option B is the quickest way to get things back on track. Who has time to copy all that data, am I right?

Adell 2 years ago

↳ replying to Cory

In this case, speed might be more important to minimize the risk of exposure.

Precious 2 years ago

↳ replying to Cory

That's true, but it would take more time and effort to copy everything over.

Shawnee 2 years ago

↳ replying to Cory

But wouldn't it be safer to create a new bucket and copy all the objects with the new key?

Verlene 2 years ago

↳ replying to Cory

I agree, option B seems like the most efficient solution.

Amie 2 years ago

Haha, I bet the guy who exposed the key is sweating right now! Anyway, I agree with Alethea, C is the safest choice.

Arletta 2 years ago

↳ replying to Amie

Yeah, creating a new Cloud KMS key and a new Cloud Storage bucket while copying all objects with the new key sounds like the best way to go.

Pearline 2 years ago

↳ replying to Amie

I think we should go with option C, it seems like the safest choice.

Tracey 2 years ago

Option B seems simpler, just update the default CMEK key on the existing bucket. But I guess that doesn't address the risk of future objects being written without CMEK.

Twana 2 years ago

That's a good point, Daniela. It might be worth considering creating a new bucket to reduce the risk of objects being written without CMEK protection in the future.

Alethea 2 years ago

I think option C is the way to go. It's the most secure approach by creating a new bucket and re-encrypting the data with the new key.

Meghan 2 years ago

↳ replying to Alethea

I think creating a new bucket with a new key is the best way to ensure security.

Jesusita 2 years ago

↳ replying to Alethea

But wouldn't it be easier to just rotate the key with option A?

Annita 2 years ago

↳ replying to Alethea

I agree, option C seems like the safest choice.

Daniela 2 years ago

But wouldn't it be safer to create a new Cloud Storage bucket and copy all objects with the new Cloud KMS key specified?

Owen 2 years ago

I agree with Twana. It's important to rotate the compromised key and update the default CMEK key to ensure security.

Twana 2 years ago

I think we should create a new Cloud KMS key and set it as the default CMEK key on the existing Cloud Storage bucket.

Google Professional Data Engineer Exam - Topic 5 Question 90 Discussion