Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process. What should you do?
A.
Use the Cloud Key Management Service to manage a data encryption key (DEK).
B.
Use the Cloud Key Management Service to manage a key encryption key (KEK).
C.
Use customer-supplied encryption keys to manage the data encryption key (DEK).
D.
Use customer-supplied encryption keys to manage the key encryption key (KEK).
The anwser is:C
This is a Customer-supplied encryption keys (CSEK).
We generate our own encryption key and manage it on-premises.
A KEK never leaves Cloud KMS.There is no KEK or KMS on-premises.
Encryption at rest by default, with various key management options
https://cloud.google.com/security/encryption-at-rest
Correct Answer -D - CSEK provided by the customer, Key encryption key (KEK) for chunk keys. Wraps the chunk keys. As per https://cloud.google.com/docs/security/encryption/customer-supplied-encryption-keys#cloud_storage. Some of us have provided correct link but not interpreted correctly and selected answer C, which is not correct. A & B not correct because it is CSEK.
By using customer-supplied encryption keys (CSEK) to manage the data encryption key (DEK), you can ensure that the encryption process utilizes a key that was generated and controlled on-premises, meeting your security and compliance requirements.
Can't be A/B because "key generated on-premises" requirement. KEK ist KMS specific.
Why (C):
https://cloud.google.com/docs/security/encryption/customer-supplied-encryption-keys#cloud_storage --> "The raw CSEK is used to unwrap wrapped chunk keys, to create raw chunk keys in memory. These are used to decrypt data chunks stored in the storage systems. These keys are used as the data encryption keys (DEK) in Google Cloud Storage for your data."
D , CSEK is used for KEK , DEK is always generated by Google as different chunks use different DEK
Raw CSEK Storage system memory Provided by the customer.
Key encryption key (KEK) for chunk keys.
Wraps the chunk keys. Customer-requested operation (e.g., insertObject or getObject) is complete
https://cloud.google.com/docs/security/encryption/customer-supplied-encryption-keys
To use a key generated on-premises for encrypting data in Cloud Storage, you should:
C. Use customer-supplied encryption keys to manage the data encryption key (DEK).
With customer-supplied encryption keys (CSEK), you can provide your own encryption keys, generated and managed on-premises, to encrypt and decrypt data in Cloud Storage. The data encryption key (DEK) is the key used to encrypt the actual data, and by using CSEK, you can manage this key with your own on-premises key management system.
Options A and B involve using Google Cloud's Key Management Service (KMS), which generates and manages encryption keys within Google Cloud, not on-premises.
Option D is not a common practice and is not directly supported for encrypting data in Cloud Storage.
The Answer is C. The raw CSEK is used to unwrap wrapped chunk keys, to create raw chunk keys in memory. These are used to decrypt data chunks stored in the storage systems. These keys are used as the data encryption keys (DEK) in Google Cloud Storage for your data.
https://cloud.google.com/docs/security/encryption/customer-supplied-encryption-keys#cloud_storage
Answer is C:
https://cloud.google.com/docs/security/encryption/customer-supplied-encryption-keys#cloud_storage
If you look at the ENTIRE process - it CSEK is used to create the DEK (final product) for decryption if its data...
C . The answer is C and I don't understand why some people here rewriting google official doc here and saying answer is D?? Here is the link please read it carefully this is not an Instagramm feed. Please when you reading 3 seconds and come here you start confusing many people . Here is link SPECIFICALLY FOR CLOUD STORAGE . https://cloud.google.com/docs/security/encryption/customer-supplied-encryption-keys#cloud_storage
I'm confused here - the article on Google says literally:
"Raw CSEK - Provided by the customer.
Key encryption key (KEK) for chunk keys.
Wraps the chunk keys".
In other words - KEK, not DEK
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
HateMicrosoft
Highly Voted 3 years, 8 months agosudarchary
Highly Voted 2 years, 9 months agobrpjp
Most Recent 2 months, 1 week agoMr_MIXER007
2 months, 3 weeks ago3d9563b
4 months agosalamKvelas
6 months, 1 week agoshanwford
6 months, 3 weeks agomadcloud32
8 months, 3 weeks agomjcts
9 months, 3 weeks agorsamant
11 months, 4 weeks agorottzy
1 year, 2 months agoXoxoo
1 year, 2 months agoXoxoo
1 year, 2 months agoananta93
1 year, 2 months agodesertlotus1211
1 year, 2 months agoRuchiMishra
1 year, 3 months agocivilizador
1 year, 3 months agoMaryKey
1 year, 2 months ago[Removed]
1 year, 4 months ago