Question

A security architect at a healthcare company is reviewing how Google Cloud protects stored data by default. She wants to understand how Google manages the large number of encryption keys needed to protect data at rest across its infrastructure without manual overhead. Which approach does Google Cloud use to efficiently manage these encryption keys at scale?

Accepted Answer

Data is encrypted with data encryption keys, which are themselves encrypted (wrapped) by key encryption keys in a technique called envelope encryption.

Answer

Customers must manually rotate and store all encryption keys in an on-premises hardware security module before uploading data.

Answer

A single master key encrypts all customer data across every Google Cloud region to simplify management.

Answer

Data is left unencrypted at rest and is only encrypted when it travels between services over the network.