You run Kafka and Redis on Compute Engine and need data-at-rest encryption with keys you can create, rotate, and destroy. What should you do?

The correct approach is to create keys in Cloud Key Management Service (Cloud KMS) and use them to encrypt data on your Compute Engine instances. Cloud KMS provides a managed service for creating, storing, and managing cryptographic keys, offering the control over key lifecycle (creation, rotation, destruction) that you require. You would integrate these keys with your applications running on Compute Engine (Kafka and Redis) to perform encryption and decryption of your data at rest. Incorrect options: Creating a dedicated service account and using Compute Engine encryption-at-rest referenced in API calls is incorrect because Compute Engine's default encryption-at-rest uses Google-managed keys, not customer-managed keys with the specified control. Creating keys locally and uploading them to Cloud KMS is not the standard or most secure practice for generating keys that will be managed by Cloud KMS; keys should ideally be generated within the secure environment of Cloud KMS itself. Creating keys in Cloud KMS and referencing them in API calls when accessing instance data is too vague and doesn't explicitly state that these keys are then used to encrypt data on the instances, which is the core requirement. While you would reference KMS keys in API calls, the critical step is their application to encrypt the data.