Professional Cloud Architect · Free Practice Question Medium
Question 28
You are designing a cloud solution for a financial services company that requires strict compliance with data security regulations. Your application needs to handle sensitive customer data, and you must ensure all data at rest and in transit is appropriately encrypted. Which of the following approaches best aligns with security and compliance standards for managing encryption keys and secrets?
-
A
Utilize self-managed encryption keys stored on-premises, and use VPN connections to access these keys from cloud services as needed.
-
B
Use Cloud Key Management Service (KMS) to manage encryption keys and Cloud Identity-Aware Proxy (IAP) to handle access to those keys.
-
C
Store encryption keys in a regular cloud storage bucket and manage access using IAM roles.
-
D
Embed encryption keys directly into application code to ensure they are readily available for use in encryption and decryption processes.
Reveal correct answer
Correct answer: B
A.
While using on-premises keys adds a level of control, it complicates the architecture and can introduce latency and complexity in key retrieval during critical operations, potentially violating compliance requirements for quick data access.
B.
Cloud KMS provides managed security and control over encryption keys, while IAP helps control access to applications and services based on identity, thus ensuring both key security and proper access management.
C.
Storing encryption keys directly in cloud storage without a dedicated security service is risky and does not comply with best practices for key management and data security.
D.
Hard-coding encryption keys in the application code is insecure as it exposes the keys in source control and to anyone who has access to the application code.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
