Google Cloud Professional Cloud Security Engineer Practice Exam

If your organization requires Customer Managed Encryption Keys (CMEK), what should you do with existing files stored using Google Managed Encryption Keys (GMEK)?

1. Transfer files to another cloud provider

2. Change the encryption type on the bucket to CMEK

3. Leave the files unchanged

4. Delete the files and start over

The correct answer is: Change the encryption type on the bucket to CMEK

When an organization requires Customer Managed Encryption Keys (CMEK) for data protection, the appropriate action to take with existing files that are currently utilizing Google Managed Encryption Keys (GMEK) is to change the encryption type on the storage bucket to CMEK. This allows the organization to transition from using the default, Google-managed keys to keys that are specified and managed by the organization itself. Switching the encryption type to CMEK enables the organization to have greater control over encryption and decryption processes, ensure compliance with internal security policies, and provide the ability to quickly revoke access to data by managing the keys directly. Using CMEK leads to a more robust security model, particularly for organizations with stringent regulatory requirements or those that require more granular control over their data security. This transition process typically involves re-encrypting existing data using the customer-managed keys. It’s important to ensure that the organization understands the necessary steps for this process to avoid potential data access issues during and after the transition.