You must control your own encryption keys. What do you use?
Why A is the answer
Customer-managed keys in Cloud KMS
Customer-managed keys in Cloud KMS let you control your own encryption keys.
In detail
- Customer-managed keys in Cloud KMS give you control.
- Control comes with responsibility.
Use case
An illustrative scenario, not a real incident.
A regulated firm controls its own keys in Cloud KMS, and can disable them.
See it in different ways
mindmap
root((Security))
Identity
Workload Identity Federation
Impersonation
Separation of duties
Data
Customer-managed keys
VPC Service Controls
Policy
Organization level
AI
Model Armorflowchart LR S0["Create key in Cloud KMS"] --> S1["Use it on the resource"] --> S2["Rotate or disable"]
Key point: Customer-managed keys give control.
Why the other options are wrong
- B. A password in a code comment
- A comment exposes it.
- C. A public bucket with long names
- That is unsafe.
- D. A shared service account key
- That is a credential, not an encryption key.