Which GUI service moves files to Cloud Storage with customer-managed encryption keys?

You have several different file type data sources, such as Apache Parquet and CSV. You want to store the data in Cloud Storage. You need to set up an object sink for your data that allows you to use your own encryption keys. You want to use a GUI-based solution. What should you do?

Use Storage Transfer Service to move files into Cloud Storage.
Use Cloud Data Fusion to move files into Cloud Storage. Source Reference Answer
Use Dataflow to move files into Cloud Storage.
Use BigQuery Data Transfer Service to move files into BigQuery.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests your ability to distinguish between GUI-based data transfer services and their encryption capabilities. The common trap is selecting Storage Transfer Service because it is GUI-based and moves files to Cloud Storage, but it lacks CMEK support, which the question explicitly requires.

For GUI-based ingestion of Parquet and CSV files into Cloud Storage using your own encryption keys, Cloud Data Fusion is the correct choice. Community consensus strongly favors Cloud Data Fusion because it is a code-free, GUI data integration service that supports Customer-Managed Encryption Keys (CMEK), whereas Storage Transfer Service does not.

The most common wrong answer is A, Storage Transfer Service. Candidates choose it because it is a GUI-based tool designed to move files into Cloud Storage, but Storage Transfer Service does not support customer-managed encryption keys (CMEK), as noted in its documentation.

Community Discussion (10 comments)

raaad 👍 10 Selected: B

Cloud Data Fusion is a fully managed, code-free, GUI-based data integration service that allows you to visually connect, transform, and move data between various sources and sinks. - It supports various file formats and can write to Cloud Storage. - You can configure it to use Customer-Managed Encryption Keys (CMEK) for the buckets where it writes data.

Helinia 👍 6 Selected: B

Even though storage transfer service can be used in GUI, it does not support CMEK which is required in this question. "Storage Transfer Service does not encrypt data on your behalf, such as in customer-managed encryption keys (CMEK). We only encrypt data in transit." Ref: https://cloud.google.com/storage-transfer/docs/on-prem-security

vishavpreet 👍 1 Selected: B

Cloud Data Fusion is a fully-managed, cloud native, enterprise data integration service for quickly building and managing data pipelines. Graphically, no coding solution.

hussain.sain 👍 1 Selected: B

B is answer as requirement is for GUI and sink

baimus 👍 1

I acknolwedge that the question wants the answer to be B, so I'm calling it as B. I don't like this though, as can't we just create a bucket with a CMEK upfront and then use the storage transfer service? It would be easier and cheaper, and achieve the same thing. The language of "sink" strongly suggests to me they intend this to be B though, as datafusion uses that terminology, and the CMEK thing is probably indicating that datafusion can encrypt for you with CMEK.

hanoverquay 👍 1 Selected: B

option 8

ashdam 👍 1 Selected: B

B just because tranfer service does not support CMEK A: GUI + encryption but no CMEK. B: Its GUI ETL + support CMEK but not sure why you need an ETL tool for transfering something once? (No scheduling or event-driven trigger is mentioned)

casadocc 👍 1

B if data fusion creates the bucket. We could create the bucket and associate, in this case A is better.

task_7 👍 3 Selected: A

A. Use Storage Transfer Service to move files into Cloud Storage. move files into Cloud Storage should be Storage Transfer Service Cloud Data Fusion is like using a tank to kill an ant

scaenruy 👍 1 Selected: B

B. Use Cloud Data Fusion to move files into Cloud Storage.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Cloud Data Fusion is a fully managed, code-free, GUI-based data integration service that lets you visually build pipelines. It supports many source and sink types, including Cloud Storage, and can write data in formats like Parquet and CSV. Additionally, Cloud Data Fusion allows you to configure customer-managed encryption keys (CMEK) for the buckets it writes to, satisfying the requirement to use your own encryption keys. This makes option B the only choice that meets all requirements simultaneously.

Why the Other Options Are Wrong

Option A, Storage Transfer Service, is a GUI-based service for moving files into Cloud Storage, but it does not support CMEK. As one community comment notes, "Storage Transfer Service does not encrypt data on your behalf, such as in customer-managed encryption keys (CMEK). We only encrypt data in transit." Option C, Dataflow, is not a GUI-only solution; it requires writing pipelines in code or using templates, and while it can support CMEK, it is not a GUI-based solution. Option D, BigQuery Data Transfer Service, targets BigQuery as a destination, not Cloud Storage, so it does not fit the stated object sink requirement.

Community Comment Notes

Community comments overwhelmingly support B, with 88 votes. A highly-liked comment explains that Cloud Data Fusion is a "fully managed, code-free, GUI-based data integration service" and that it supports CMEK. Another useful comment points out the flaw in option A: Storage Transfer Service lacks CMEK, referencing the official on-prem security page. Some commenters note that Storage Transfer Service could be made to work if you create a bucket with CMEK beforehand, but the question's use of the word "sink" strongly suggests the intended answer is Cloud Data Fusion, which natively uses that terminology.

Official Reference

Exam Strategy

When a question requires both a GUI and custom encryption keys, immediately look for the service that supports CMEK—Cloud Data Fusion. Eliminate Storage Transfer Service because its official docs state it does not use customer-managed encryption keys, even though it is GUI-based and moves files to Cloud Storage.

Related Analysis

← Back to PDE Study Guide