Question

A financial services company encrypts all Compute Engine persistent disks with a CMEK stored in Cloud KMS. During a suspected credential compromise, the security team must immediately render all data on those disks inaccessible while preserving the ability to restore access after the incident is investigated and cleared. Which action best meets this requirement?

Accepted Answer

Disable the CMEK key version in Cloud KMS, then re-enable it once the incident is cleared.

Answer

Schedule the CMEK key version for destruction, which starts a 30-day recovery window.

Answer

Remove all IAM bindings that grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the key.

Answer

Rotate the CMEK key to a new primary version so the old data can no longer be decrypted.