Exam Professional Data Engineer topic 1 question 298 discussion

- New Key Creation: A new Cloud KMS key ensures a secure replacement for the compromised one. - New Bucket: A separate bucket prevents potential conflicts with existing objects and configurations. - Default CMEK: Setting the new key as default enforces encryption for all objects in the bucket, reducing the risk of unencrypted data. - Copy Without Key Specification: Copying objects without specifying a key leverages the default key, simplifying the process and ensuring consistent encryption. - Old Key Deletion: After copying, the compromised key can be safely deleted.

Wrong: A - rotating external key doesn't trigger re-encryption of data already in GCS: https://cloud.google.com/kms/docs/rotate-key#rotate-external-coordinated C - Setting key during copy doesn't take care of objects that are later uploaded to the bucket, that will still use the default key

If no key is specified, and the bucket's default CMEK key is used, there's a risk that some objects might fall back to Google-managed encryption, especially if misconfigured

Option D

The correct answer is D. Rotating the key does not seem to re-encrypt: In the event that a key is compromised, regular rotation (!!) limits the number of actual messages vulnerable to compromise (!!). If you suspect that a key version is compromised, disable it and revoke access to it as soon as possible. Source: https://cloud.google.com/kms/docs/key-rotation#why_rotate_keys

I don't understand why only Matt select A https://cloud.google.com/sdk/gcloud/reference/kms/keys/update This seems to do the job, am I wrong ?

Definitely A