Archive highly sensitive files to Cloud Storage using a Trust-No-One approach so provider staff cannot decrypt them. What should you do?
Choose an answer
Tap an option to check your answer.
Correct answer: Create a symmetric key with Cloud KMS, run gcloud kms encrypt on each file using unique AAD, upload the encrypted files with gsutil cp, and keep the AAD outside Google Cloud..
Why this is the answer
The correct option ensures a "Trust-No-One" approach by encrypting files client-side with Cloud KMS and using unique Additional Authenticated Data (AAD) kept outside Google Cloud. This means Google staff cannot decrypt the files, even if they gain access to the KMS key, because they lack the AAD. The other options are less secure. Encrypting with gcloud kms encrypt without unique AAD means the key alone can decrypt the data. Using CSEK stored in Cloud Memorystore or another Google Cloud project still places the key within Google's infrastructure, potentially exposing it to provider staff if they compromise the storage. Destroying and rotating the key after upload doesn't prevent decryption if the key was compromised before destruction.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed