Google Cloud Professional Cloud Security Engineer PCSE — Topic 1 Question 351

Question

Your global defense company is migrating top-secret classified data to BigQuery and Cloud Storage. National security regulations demand that master encryption key material never leaves the accredited on-premises cryptographic hardware. You must retain the unilateral ability to revoke data access, independent of any cloud provider. What should you do?

Accepted Answer

Correct answer: D. The correct answer is D. Option D: Configure Cloud External Key Manager (Cloud EKM) for the BigQuery datasets and Cloud Storage buckets. Integrate EKM with your existing on-premises hardware security modules (HSMs). Cloud Storage provides durable, scalable object storage that is fully managed. BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage. Cloud External Key Manager lets you hold encryption keys outside Google Cloud.

Google Cloud Professional Cloud Security Engineer PCSE — Question 351