Exam Professional Cloud Security Engineer topic 1 question 45 discussion

CSEK is only supported in Google Cloud Storage and Compute Engine, therefore D cannot be the right answer. Ideally, it would be client-side encryption, with BigQuery providing another round of encryption of the encrypted data - https://cloud.google.com/bigquery/docs/encryption-at-rest#client_side_encryption, but since that is not one of the options, we can go with C as the next best option.

Correct answer is b

I prefer D for max control.

Correct answer is D D. Customer-supplied encryption keys (CSEK). Here's an explanation of why CSEK is the best choice and a brief review of the other options: Customer-supplied encryption keys (CSEK): CSEK allows the institution to manage their own encryption keys and supply these keys to Google Cloud Platform when needed. This provides maximum control over the encryption process because the institution retains possession of the encryption keys and can rotate, revoke, or replace them as desired.

Why not Cloud HSM ? Maximum control over keys

C. Customer-managed encryption keys (CMEK).

Ans : C

I feel C is the right answer. if customer wants to manage the keys from on-premises then D would be correct.

Ans - C

C is correct answer as CSEK is not available for big query.

C is the right answer as CSEC is only available for CS and CE's

Correct Answer: C

C is the RIGHT ONE!!! If you want to manage the key encryption keys used for your data at rest, instead of having Google manage the keys, use Cloud Key Management Service to manage your keys. This scenario is known as customer-managed encryption keys (CMEK). https://cloud.google.com/bigquery/docs/encryption-at-rest

Ans is C. BigQuery does not support CSEK. https://cloud.google.com/security/encryption-at-rest. https://cloud.google.com/security/encryption-at-rest

I also feeel D is right

Answer is D. For max control you don't want to store the Key with Google.

For maximum control surely D is the correct answer. CSEK: https://cloud.google.com/security/encryption-at-rest/customer-supplied-encryption-keys CMEK https://cloud.google.com/bigquery/docs/encryption-at-rest