Professional Cloud Security Engineer

D. Customer-managed encryption keys (CMEK) with Cloud KMS

Cloud SQL supports Customer-managed encryption keys (CMEK) via Cloud Key Management Service (KMS). Cloud KMS offers various key types, including those backed by Cloud HSM, which is FIPS 140-2 Level 3 validated. This allows the company to meet their specific compliance requirement for key storage.

C. Column-level security with data masking

Column-level security with data masking allows specific columns to be masked (e.g., partially hidden or tokenized) for users who do not have the appropriate permissions, while still allowing queries on the masked data for aggregate analysis. This meets the requirement of never showing plain text PHI but still allowing aggregate queries.

A. Apply a bucket-level retention policy of seven years and enable 'Object Lock' for the bucket.

A bucket-level retention policy with Object Lock enabled ensures that objects are immutable and cannot be deleted or modified for the specified duration, even by administrators with 'Owner' roles, thus meeting the strict immutability and regulatory requirements.

B. CryptoReplaceFfxFpe

CryptoReplaceFfxFpe (Format-Preserving Encryption with FFX mode) is specifically designed to replace sensitive data with an encrypted value that maintains the original format, such as the number of digits in a credit card number. This method is irreversible without the key, making it suitable for strong de-identification while preserving data utility for analysis.

C. VPC Service Controls

VPC Service Controls create a security perimeter around Google Cloud resources (like BigQuery datasets and Cloud Storage buckets) to restrict data movement and access only from authorized networks and clients. It prevents data exfiltration and ensures that sensitive data remains within the defined perimeter, meeting all the specified requirements.

B. Hardware-backed keys (Cloud HSM)

Hardware-backed keys (Cloud HSM) in Cloud KMS provide a FIPS 140-2 Level 3 validated hardware security module for key generation and storage, ensuring high security, availability, and durability. Key access is centrally managed and auditable through Cloud KMS and Cloud Audit Logs.

D. Configure the bucket's default encryption to use the specified CMEK key.

Configuring the bucket's default encryption to use a specified CMEK key ensures that all new objects uploaded to that bucket are automatically encrypted with CMEK. This setting also prevents uploads of unencrypted objects or objects encrypted with Google-managed keys.

C. VPC Service Controls

VPC Service Controls create security perimeters around Google Cloud resources (like BigQuery datasets) to prevent data exfiltration. It ensures that data remains within a defined perimeter and can only be accessed from authorized networks, directly addressing the requirement of preventing data from leaving the Google Cloud environment and restricting access to a specific VPC.

D. HSM

The HSM key protection level in Cloud KMS ensures that keys are generated and used within FIPS 140-2 Level 3 certified hardware security modules. This meets the requirement for hardware-backed security and cryptographic operations within a secure boundary, while still allowing the keys to be managed within Google Cloud's infrastructure.

B. Assured Workloads

Assured Workloads is specifically designed for customers with stringent compliance and sovereignty requirements, such as government agencies. It helps enforce compliance by providing controls over data residency, personnel access (e.g., limiting Google support to specific geographies or personnel), and ensuring workloads run on certified infrastructure (e.g., FedRAMP, IL4, IL5).

D. Secret Manager automatic rotation with a custom rotation function

Secret Manager's automatic rotation feature, combined with a custom rotation function (typically a Cloud Function), allows secrets to be programmatically updated at a specified interval (e.g., 90 days). This rotation process creates new secret versions and can be configured to automatically disable older versions after a grace period, meeting all requirements.

C. Assured Workloads

Assured Workloads helps customers meet specific compliance and regulatory requirements by providing predefined environments that enforce data residency, personnel access, support, and operational controls tailored to various compliance regimes (e.g., FedRAMP, IL4, C5).

A. Secret Manager automatic rotation with a custom rotation function.

Secret Manager's automatic rotation feature, combined with a custom rotation function (typically implemented as a Cloud Function), is designed to automatically generate and rotate new secret versions at a specified interval, such as every 90 days, without manual intervention.

A. CryptoReplaceFfxFpe

To maintain referential integrity while replacing sensitive data with a tokenized value, the CryptoReplaceFfxFpe transformation method is the most suitable. It uses format-preserving encryption to generate consistent, tokenized outputs for the same input values.

A. Cloud KMS default key for a project or folder

Configuring a Cloud KMS default key at the project or folder level allows new resources created in supported services (like Cloud Storage, BigQuery, Cloud SQL) to automatically use that specified customer-managed encryption key (CMEK) for encryption at rest. This centralizes key management and ensures consistent application of the organizational encryption policy without manual configuration for each resource.

D. Assured Workloads

Assured Workloads directly addresses stringent compliance and sovereignty requirements by providing a Google Cloud environment that helps enforce data residency, restrict Google personnel access, and align with specific compliance frameworks like HIPAA, PCI DSS, and FedRAMP. It automates the configuration of controls to meet these mandates.

D. Cloud External Key Manager (EKM) with Cloud KMS.

To achieve full control and management of encryption keys outside of Google Cloud, with the ability to revoke access at any time, Cloud External Key Manager (EKM) is the correct choice. EKM allows Google Cloud services to use keys residing in an external, customer-managed key management system, with Cloud KMS acting as an intermediary.

C. Cloud Asset Inventory and Security Health Analytics.

Cloud Asset Inventory provides a centralized inventory of all Google Cloud assets, including Cloud Storage buckets and their configurations. Security Health Analytics (part of Security Command Center) can then scan this inventory for compliance deviations, such as buckets without uniform bucket-level access enabled, and report them.

A. Cloud External Key Manager (EKM)

Cloud External Key Manager (EKM) allows organizations to encrypt data in Google Cloud using keys that are managed and stored outside of Google's infrastructure, meeting strict regulatory requirements for external key control.

D. Cloud Audit Logs with export to a WORM-compliant Cloud Storage bucket.

Cloud Audit Logs automatically records administrative activities and data access for Cloud Storage. Exporting these logs to a Cloud Storage bucket configured with Object Lock in WORM (Write Once, Read Many) mode ensures immutability and long-term retention for compliance, making the audit trail tamper-proof for seven years.

B. Configure a rotation schedule directly in the Secret Manager UI or gcloud CLI.

Secret Manager provides a built-in feature to configure an automatic rotation schedule for secrets. This allows you to specify a rotation period (e.g., 90 days) and a Cloud Function that will be invoked to perform the actual secret update, simplifying compliance with rotation policies.

B. Enable Admin Activity logs for Cloud Storage and configure a Cloud Storage bucket as a sink with a retention policy.

Admin Activity logs record administrative actions, including creating, deleting, or modifying bucket policies. Exporting these logs to a Cloud Storage bucket configured as a sink, with an appropriate retention policy and Object Lock enabled, will ensure they are retained for seven years in an immutable format for auditing.

B. BigQuery column-level security with data masking

BigQuery column-level security with data masking allows sensitive data within specific columns to be obfuscated for most users, while still permitting full access to raw data for authorized roles, precisely matching the requirement.

C. Configure Cloud SQL with a private IP address and Cloud VPN/Interconnect, enforcing SSL/TLS.

Using a private IP address for Cloud SQL ensures the instance is not exposed to the public internet. Connecting from on-premises via Cloud VPN or Cloud Interconnect establishes a secure, private network path. Enforcing SSL/TLS encrypts and authenticates the traffic over this private connection, meeting all requirements.

C. Enable uniform bucket-level access on the buckets and configure a VPC Service Controls perimeter.

Uniform bucket-level access ensures that all objects in a bucket inherit IAM policies from the bucket, effectively preventing object ACLs from making data publicly accessible. A VPC Service Controls perimeter further prevents data exfiltration by creating a security boundary around Cloud Storage, and it allows defining ingress rules to permit API calls from trusted on-premises networks.