Google Cloud Professional Cloud Security Engineer Practice Exam

Which steps are involved in encrypting data using envelope encryption?

1. Generate a key, encrypt with DEK, wrap DEK with KEK, and store data

2. Encrypt data first, generate DEK, wrap KEK, and store wrapped key

3. Generate KEK, encrypt DEK, store encrypted DEK, and manage keys

4. Generate key, store data, wrap keys, and delete unwrapped keys

The correct answer is: Generate a key, encrypt with DEK, wrap DEK with KEK, and store data

The process of envelope encryption is designed to enhance data security by using multiple layers of encryption. The correct answer involves several key steps that clearly define this process. First, generating a data encryption key (DEK) is crucial as this key is used to encrypt the actual data. The DEK is often a symmetric key, meaning the same key is used for both encryption and decryption of the data. Once the DEK is generated, the next step is to encrypt the data using this DEK, ensuring that the sensitive data is protected right away. Following the encryption of data, the DEK itself must be secured. To achieve this, the DEK is wrapped (encrypted) with a key encryption key (KEK). The KEK is typically more secure and can even be a higher-level key stored in a more secure manner, making it a crucial part of the envelope encryption strategy. The final step involves storing the encrypted data along with the wrapped DEK. This setup allows the data to be encrypted while the DEK remains secure, as it is necessary for decrypting the data later. The separation of the DEK from the data itself helps to minimize the risk of exposing sensitive information in case of a security breach. In summary, this