Exam Professional Cloud Security Engineer topic 1 question 173 discussion

The only 2 options that satisfy FIPS 140-2 Level 3 requirement are Cloud HSM or Cloud EKM. https://cloud.google.com/kms/docs/key-management-service#choose

B. Customer-managed encryption keys with Cloud HSM

Cloud HSM helps you enforce regulatory compliance for your workloads in Google Cloud. With Cloud HSM, you can generate encryption keys and perform cryptographic operations in FIPS 140-2 Level 3 validated HSMs.

To meet the given requirements, you should recommend using Customer-managed encryption keys with Cloud HSM. This solution allows you to manage your own encryption keys while leveraging the Google Cloud Hardware Security Module (HSM) service, which is FIPS 140-2 Level 3 validated. With Cloud HSM, you can rotate the master key at least once every 45 days and store it in multiple regions within the US for redundancy. While Customer-managed encryption keys with Cloud Key Management Service (KMS) (option A) is a valid choice for managing encryption keys, it does not provide the FIPS 140-2 Level 3 validation required by the given requirements. Customer-supplied encryption keys (option C) are not suitable for this scenario as they do not offer the same level of control and security as customer-managed keys. Google-managed encryption keys (option D) would not meet the requirement of having a solution that stores the master key validated at FIPS 140-2 Level 3.

In all options only HMS have L3 validation

Answer: B https://cloud.google.com/docs/security/cloud-hsm-architecture

Cloud HSM is right answer

Cloud HSM is right answer is B

B.Cloud HSM can be rotated automatically(same front end as KMS), FIPS 140-2 level 3 validated, support multi-region.

B is the answer.

Both A and B. But question ask for redundancy. So I think it's A.

B. https://cloud.google.com/docs/security/key-management-deep-dive https://cloud.google.com/kms/docs/faq "Keys generated with protection level HSM, and the cryptographic operations performed with them, comply with FIPS 140-2 Level 3."

This should be definitely A. Only Cloud KMS supports FIPS 140-2 levels1, 2 and 3. https://cloud.google.com/kms/docs/faq#standards