Question

A financial services company is drafting a security whitepaper for auditors. The auditors ask how Google Cloud protects customer data stored in Cloud Storage and Persistent Disk by default, without the customer configuring anything. The architect must accurately describe the default encryption-at-rest mechanism. Which statement correctly describes Google Cloud's default data-at-rest encryption?

Accepted Answer

Data is automatically encrypted at rest using AES-256 with a key hierarchy in which data encryption keys (DEKs) are wrapped by key encryption keys (KEKs) stored in Google's internal KMS, requiring no customer action.

Answer

Data is only encrypted at rest if the customer enables Customer-Managed Encryption Keys (CMEK) in Cloud KMS; otherwise the data is stored in plaintext.

Answer

Data is encrypted at rest only when Customer-Supplied Encryption Keys (CSEK) are provided in each API request, and Google discards the key after the operation.

Answer

Data is protected at rest solely through VPC Service Controls perimeters and IAM policies rather than cryptographic encryption.