You must encrypt all BigQuery data using keys generated and stored only on your on-premises HSM while using Google-managed services. Which approach do you implement?
Choose an answer
Tap an option to check your answer.
Correct answer: Create the encryption key in the on-premises HSM and link it to a Cloud External Key Manager (Cloud EKM) key. Associate the created Cloud KMS key while creating the BigQuery resources..
Why this is the answer
The correct approach is to use Cloud External Key Manager (Cloud EKM). Cloud EKM allows you to protect your data in Google Cloud with encryption keys that are stored and managed in a third-party key management system (like your on-premises HSM) outside of Google's infrastructure. This meets the requirement that keys are generated and stored only on your on-premises HSM. You link the on-premises key to a Cloud EKM key, which is then used by BigQuery. Importing keys into Cloud KMS (whether a software key or a Cloud HSM key) would store a copy of the key within Google Cloud, violating the "only on your on-premises HSM" requirement. Encrypting data during ingestion without a specific key management integration doesn't meet the requirement for using your on-premises HSM keys.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed