How to Audit External Key Usage and Deny Decrypt Requests in GCP?

PCSE By islever Editorial Last updated

Short answer

C Implement Cloud External Key Manager with Key Access Justifications to integrate with your existing on-premises key management solution.

Question

You work for a banking organization. You are migrating sensitive customer data to Google Cloud that is currently encrypted at rest while on-premises. There are strict regulatory requirements when moving sensitive data to the cloud. Independent of the cloud service provider, you must be able to audit key usage and be able to deny certain types of decrypt requests. You must choose an encryption strategy that will ensure robust security and compliance with the regulations. What should you do?
  1. Utilize Google default encryption and Cloud IAM to keep the keys within your organization's control.
  2. Implement Cloud External Key Manager (Cloud EKM) with Access Approval, to integrate with your existing on-premises key management solution.
  3. Implement Cloud External Key Manager (Cloud EKM) with Key Access Justifications to integrate with your existing one premises key management solution. Correct Answer
  4. Utilize customer-managed encryption keys (CMEK) created in a dedicated Google Compute Engine instance with Confidential Compute encryption, under your organization's control.

Key Takeaways

Tests your understanding of external key management controls, specifically confusing Access Approval’s Google personnel restrictions with Key Access Justifications’ external audit and deny capabilities.

This page explains how Cloud External Key Manager paired with Key Access Justifications enables independent audit trails and policy enforcement for external decryption requests. It confirms that combining these features satisfies strict banking compliance requirements without relying on Google’s internal controls.

Common mistake: Many candidates select Access Approval because it sounds like a security gate, but it only restricts Google staff access rather than providing an audit trail for external key partners to evaluate decryption reasons.

Expert Analysis

Why the Answer Is Correct

Implementing Cloud External Key Manager alongside Key Access Justifications directly addresses the requirement to audit key usage and control decryption outside Google’s infrastructure. When enabled, every decryption request automatically includes a justification field that travels to your on-premises key management system. Your external partner can then log this activity for full transparency and apply custom business logic to block specific decrypt operations based on the stated reason.

Why the Other Options Are Wrong

Option A relies on Google-managed defaults, which completely bypasses your on-premises infrastructure and eliminates independent auditing. Option B configures Access Approval, which strictly governs whether Google employees can view your metadata or resources, not how external cryptographic partners handle decryption traffic. Option D stores keys within GCP’s Compute Engine environment, violating the mandate to keep key management independent of the cloud provider.

Community Comment Notes

Several learners highlighted that the justification field sent to external partners enables precise allow or deny decisions based on request context. As one user noted, "each request to your external key management partner includes a field that identifies the reason". Another contributor emphasized that this mechanism satisfies regulatory demands for transparent decryption logging. While a few argued for broader access controls, the consensus correctly aligns with the external audit requirement.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always map regulatory keywords like "audit key usage" and "deny requests independent of CSP" directly to external key management features. Prioritize solutions that pass control logic to your existing infrastructure rather than adopting native Google-only controls when compliance mandates independence.

Frequently Asked Questions

Why is Access Approval insufficient for external key auditing?

Access Approval only restricts Google personnel access to your resources. It does not transmit justification fields to external KMS partners for audit or denial purposes.

Can Key Access Justifications replace on-premises key management?

No, it complements your existing infrastructure by sending request reasons to your external KMS. Your on-premises system retains full control over allow or deny decisions.

More PCSE FAQ →

Community Votes

C
67%
B
33%

67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. json4u 👍 5
    Answer is C. - Access Approval : This lets you control access to your organization's data by Google personnel. - Key Access Justifications : This provides a justification for every request to access keys stored in an external key manager.
  2. dv1 👍 3 Answered C
    Key Access Justifications does what the question asks for.
  3. MoAk 👍 2 Answered C
    Answer is C. https://cloud.google.com/kms/docs/ekm#terminology
  4. Pime13 👍 1 Answered C
    https://cloud.google.com/kms/docs/ekm#terminology https://cloud.google.com/assured-workloads/key-access-justifications/docs/overview Key Access Justifications When you use Cloud EKM with Key Access Justifications, each request to your external key management partner includes a field that identifies the reason for each request. You can configure your external key management partner to allow or deny requests based on the Key Access Justifications code provided.
  5. KLei 👍 1 Answered B
    C does not offer the same level of access control as Access Approval, which is critical for denying unauthorized decrypt requests.
Show 1 more comment
  1. yokoyan 👍 2 Answered B
    I think it's B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide