How to encrypt BigQuery data with on-premises HSM keys using Google managed solutions?
You are on the data governance team and are implementing security requirements. You need to encrypt all your data in BigQuery by using an encryption key managed by your team. You must implement a mechanism to generate and store encryption material only on your on-premises hardware security module (HSM). You want to rely on Google managed solutions. What should you do?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the difference between importing key material into Google-managed KMS/HSM versus using Cloud EKM, which allows key material to stay entirely on-premises while Google services use it via an external key management connection.
The community consensus is to create the encryption key on the on-premises HSM and attach it as a Cloud External Key Manager (Cloud EKM) key, then associate that key with BigQuery resources. This keeps key material exclusively on-premises while relying on Google's managed encryption integration.
Choosing option C (import into Cloud HSM) is the most common error because it mixes up 'HSM' with 'on-premises HSM' — importing the key into Cloud HSM actually moves the key material into Google Cloud, violating the requirement that key material remain only on-premises.
Community Discussion (7 comments)
- Cloud EKM allows you to use encryption keys managed in external key management systems, including on-premises HSMs, while using Google Cloud services. - This means that the key material remains in your control and environment, and Google Cloud services use it via the Cloud EKM integration. - This approach aligns with the need to generate and store encryption material only on your on-premises HSM and is the correct way to integrate such keys with BigQuery. ====== Why not Option C - Cloud HSM is a fully managed service by Google Cloud that provides HSMs for your cryptographic needs. However, it's a cloud-based solution, and the keys generated or managed in Cloud HSM are not stored on-premises. This option doesn't align with the requirement to use only on-premises HSM for key storage.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because Cloud EKM is specifically designed to let Google Cloud services like BigQuery use encryption keys that are managed and stored in an external key management system, such as your on-premises HSM. When you create a Cloud EKM key, Google does not store the key material; instead, BigQuery encrypts/decrypts via the Cloud EKM integration with your HSM. This aligns perfectly with the requirement to generate and store encryption material only on-premises while using Google managed solutions.
Why the Other Options Are Wrong
Option A (import into Cloud KMS) would copy the key material into Google's key management service, so Google would store and manage the key — not acceptable. Option C (import into Cloud HSM) similarly moves the key material into Google's HSM, so the key is no longer 'only on-premises.' Option D (encrypt on ingestion) does not use a managed service for key management and is impractical; BigQuery's native encryption requires associating a Cloud KMS/EKM key with the resources.
Community Comment Notes
The top comment (18 likes) by Raaad clearly explains that Cloud EKM is the right approach because it allows key material to remain in your environment and control. Comments [2] and [6] point to the official EKM documentation, reinforcing that EKM supports external key management via VPC connections. Comment [3] suggests option C, but that is incorrect because importing into Cloud HSM moves the key material to Google's HSM, violating the 'only on-premises' requirement.
Official Reference
Exam Strategy
When a question demands that key material remain 'only on-premises,' look for 'External Key Manager' or 'Cloud EKM' in the answer options — not plain Cloud KMS or Cloud HSM, which import or store key material in Google. Remember that BigQuery encryption keys must be created in Cloud KMS (including EKM/HSM keys) and associated with the dataset, tables, or resources.