Securing Data Warehouse Migration with EKM and KAJ

PCSE By islever Editorial Last updated

Short answer

CE Use Key Access Justifications for visibility into encryption key requests and Cloud External Key Manager to maintain a separate key management provider.

Question

You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must:
• Protect data at rest with full lifecycle management on cryptographic keys.
• Implement a separate key management provider from data management.
• Provide visibility into all encryption key requests.
What services should be included in the data warehouse implementation? (Choose two.)
  1. Customer-managed encryption keys
  2. Customer-Supplied Encryption Keys
  3. Key Access Justifications Correct Answer
  4. Access Transparency and Approval
  5. Cloud External Key Manager Correct Answer

Key Takeaways

The main trap is selecting standard encryption keys like CMEK without realizing they do not satisfy the specific requirements for external key separation and granular access request visibility mandated by compliance policies.

This guide explains how to secure a BigQuery, Cloud SQL, and Cloud Storage migration by combining Key Access Justifications for request visibility and Cloud External Key Manager for separated key management.

Common mistake: Choosing A (CMEK) and E (EKM) is incorrect because while EKM handles separation, neither option provides the specific visibility into key access requests that Key Access Justifications (C) offers.

Expert Analysis

The question requires selecting two services that collectively satisfy three specific compliance mandates for a data warehouse migration involving BigQuery, Cloud SQL, and Cloud Storage. The mandates are: protecting data at rest with full lifecycle management, implementing a separate key management provider from data management, and providing visibility into all encryption key requests.

Option E (Cloud External Key Manager) is essential because it satisfies the requirement to implement a "separate key management provider." By using an external KMS (such as HashiCorp Vault or AWS KMS), the encryption keys reside outside of Google Cloud, ensuring separation between the data management infrastructure and the key management infrastructure. This addresses the second mandate directly.

Option C (Key Access Justifications) is required to meet the third mandate: "Provide visibility into all encryption key requests." Key Access Justifications (KAJ) is a feature within Assured Workloads that requires personnel accessing customer content to provide a justification. These justifications are logged and made visible, satisfying the audit and visibility requirement. While some comments argue that Option A (CMEK) provides lifecycle management, CMEK does not inherently enforce the "separate provider" rule unless paired with EKM, and more importantly, CMEK alone does not provide the specific visibility into access requests that KAJ does. Furthermore, KAJ works in conjunction with EKM or CMEK, but given the explicit need for a separate provider, EKM is the foundational choice for key storage, and KAJ is the mechanism for request visibility.

The most attractive wrong approach is choosing A (CMEK) and E (EKM). While both relate to key management, this pair fails to address the visibility into key requests (access logs/justifications), which is explicitly required. Another common mistake is choosing B (CSEK), which offers no lifecycle management control to the customer, violating the first mandate. Therefore, the combination of E for external key separation and C for access visibility is the correct solution.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When questions mention "separate key management provider," immediately consider Cloud External Key Manager (EKM) or Bring Your Own Key (BYOK) scenarios where keys are externalized. When "visibility into access requests" or "justification" is mentioned, prioritize Key Access Justifications (KAJ) over standard logging, as KAJ specifically captures human intent for access. Always cross-reference service support matrices to ensure the chosen solution applies to all listed products (BigQuery, Cloud SQL, Cloud Storage).

Community Votes

E
50%
C
27%
A
23%

50% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. ArizonaClassics 👍 6
    C. Key Access Justifications Key Access Justifications can provide visibility into all encryption key requests, satisfying your third condition. This feature enables you to get justification for every request to use a decryption key, giving you the information you need to decide whether to approve or deny the request in real-time. E. Cloud External Key Manager The Cloud External Key Manager allows you to use and manage encryption keys stored outside of Google's infrastructure, thereby providing a separate key management provider from data management. This meets your first and second conditions because it enables you to fully manage the lifecycle of your cryptographic keys while storing them outside Google Cloud.
  2. gcp4test 👍 6
    Implement a separate key management provider from data management - so the key must be outside of the GCP - E Provide visibility into all encryption key requests. - this can be supported by - C
  3. akg001 👍 5
    C,E - looks correct to me
  4. adb4007 👍 4
    CE seems good for me. If you want to be compliance with "Implement a separate key management provider from data management" you must have 2 providers and "B" CSEK couldn't work i think. "E" work for the both first policies. "C" seems good for the third policy.
  5. cyberpunk21 👍 4
    looks good to me
Show 9 more comments
  1. anshad666 👍 3
    C - https://cloud.google.com/assured-workloads/key-access-justifications/docs/overview E - https://cloud.google.com/kms/docs/ekm
  2. 7f97f9f 👍 2
    A. CMEK allows you to control the encryption keys used to protect your data at rest. You have full control over the key lifecycle. This is a crucial component. C. KAJ requires that Google support personnel provide a justification for accessing customer content. It does not provide visibility into all encryption key requests. E. Cloud EKM allows you to use encryption keys that are managed in an external key management system (KMS) that you control. This fulfills the requirement of separating key management from data management. This also provides visibility into key requests, as they are being requested from your external KMS. Therefore the answer is A. and E.
  3. Sanjana2020 👍 2
    I think this is BE. They mention that they want the data and the keys to be in separate locations. So that would mean CSEK. And that is handled by External Key Manager. So BE.
  4. BPzen 👍 1
    Why Option A (Customer-Managed Encryption Keys) is Correct Control Over Keys: Customer-managed encryption keys (CMEK) allow you to manage the lifecycle of encryption keys, including rotation, revocation, and deletion, through Cloud Key Management Service (KMS). Integration with BigQuery, Cloud SQL, and Cloud Storage: CMEK is supported across BigQuery, Cloud Storage, and Cloud SQL, enabling encryption of data at rest with your managed keys. Compliance Support: CMEK satisfies the requirement to manage the full lifecycle of encryption keys.
  5. STomar 👍 1
    AE: https://cloud.google.com/kms/docs/cmek A: CMEK gives you control over the keys that protect your data at rest in Google Cloud. Using CMEK gives you control over more aspects of the lifecycle and management of your keys.
  6. Bettoxicity 👍 1
    Why not C?: KAJ focuses on managing access control for Google personnel to resources, not specifically on encryption key visibility.
  7. irmingard_examtopics 👍 1
    Encryption key requests visibility > C Separate key management provider > E
  8. YourFriendlyNeighborhoodSpider 👍 1
    AE looks correct, many people in the comments explained why, take a note.
  9. p981pa123 👍 1
    A and E

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

Integrating On-Premises Active Directory with Google Cloud IAM

S-grade

Cloud External Key Manager and Confidential VM Implementation Constraints

S-grade

← Back to PCSE Study Guide