Question

A financial services company stores highly regulated customer data in BigQuery and Cloud Storage, encrypted with Cloud KMS CMEK keys. Auditors require that any time Google or an internal automated process attempts to use these keys to decrypt data, the company can review the stated reason for access and automatically deny requests that lack an approved business justification. Which Cloud KMS capability should the security engineer configure to meet this requirement?

Accepted Answer

Enable Key Access Justifications and configure a justification policy that allows only approved reason codes, denying key use for unapproved justifications

Answer

Enable Cloud KMS key rotation on a 30-day schedule so that any unauthorized access is limited to a single key version

Answer

Configure Cloud Audit Logs for Cloud KMS to capture data access events and set up log-based alerts for decrypt operations

Answer

Migrate the CMEK keys to Cloud HSM to ensure hardware-backed key protection and FIPS 140-2 Level 3 compliance