How to Audit External Key Usage and Deny Decrypt Requests in GCP?
You work for a banking organization. You are migrating sensitive customer data to Google Cloud that is currently encrypted at rest while on-premises. There are strict regulatory requirements when moving sensitive data to the cloud. Independent of the cloud service provider, you must be able to audit key usage and be able to deny certain types of decrypt requests. You must choose an encryption strategy that will ensure robust security and compliance with the regulations. What should you do?
Community Votes
67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests your understanding of external key management controls, specifically confusing Access Approval’s Google personnel restrictions with Key Access Justifications’ external audit and deny capabilities.
This page explains how Cloud External Key Manager paired with Key Access Justifications enables independent audit trails and policy enforcement for external decryption requests. It confirms that combining these features satisfies strict banking compliance requirements without relying on Google’s internal controls.
Many candidates select Access Approval because it sounds like a security gate, but it only restricts Google staff access rather than providing an audit trail for external key partners to evaluate decryption reasons.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Implementing Cloud External Key Manager alongside Key Access Justifications directly addresses the requirement to audit key usage and control decryption outside Google’s infrastructure. When enabled, every decryption request automatically includes a justification field that travels to your on-premises key management system. Your external partner can then log this activity for full transparency and apply custom business logic to block specific decrypt operations based on the stated reason.Why the Other Options Are Wrong
Option A relies on Google-managed defaults, which completely bypasses your on-premises infrastructure and eliminates independent auditing. Option B configures Access Approval, which strictly governs whether Google employees can view your metadata or resources, not how external cryptographic partners handle decryption traffic. Option D stores keys within GCP’s Compute Engine environment, violating the mandate to keep key management independent of the cloud provider.Community Comment Notes
Several learners highlighted that the justification field sent to external partners enables precise allow or deny decisions based on request context. As one user noted, "each request to your external key management partner includes a field that identifies the reason". Another contributor emphasized that this mechanism satisfies regulatory demands for transparent decryption logging. While a few argued for broader access controls, the consensus correctly aligns with the external audit requirement.Official Reference
Exam Strategy
Always map regulatory keywords like "audit key usage" and "deny requests independent of CSP" directly to external key management features. Prioritize solutions that pass control logic to your existing infrastructure rather than adopting native Google-only controls when compliance mandates independence.
Frequently Asked Questions
Why is Access Approval insufficient for external key auditing?
Access Approval only restricts Google personnel access to your resources. It does not transmit justification fields to external KMS partners for audit or denial purposes.
Can Key Access Justifications replace on-premises key management?
No, it complements your existing infrastructure by sending request reasons to your external KMS. Your on-premises system retains full control over allow or deny decisions.