Practice Test 2 | Google Cloud Certified Professional Cloud Security Engineer | Dumps | Mock Test
Your company wants to store sensitive data in Cloud Storage. Encryption of data at rest will be done using Customer-managed encryption keys (CMEK) in Cloud KMS.
Which of the following is NOT true of envelope encryption? Choose TWO.
A. Use key encryption key (KEK) locally to encrypt your data.
B. Use data encryption key (DEK) locally to encrypt your data.
C. Create a key in Cloud KMS that will act as the key encryption key and use this key to encrypt the DEK.
D. Create a key in Cloud KMS that will act as the data encryption key and use this key to encrypt the KEK.
E. Store the encrypted data and the wrapped DEK
Answer: A, D
- Option A is CORRECT. The DEK is used to encrypt data, and the KEK is used to encrypt the DEK.
- Option B is incorrect. The DEK is used to encrypt data, and the KEK is used to encrypt the DEK.
- Option C is incorrect. The KEK is used to encrypt the DEK.
- Option D is CORRECT. The KEK is used to encrypt the DEK.
- Option E is incorrect. The encrypted data is stored along with the wrapped DEK.
Reference:
Comments are closed, but trackbacks and pingbacks are open.