Cloud KMS for key management in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when you disable a CryptoKey in Cloud KMS?

You have a CryptoKey in Google Cloud KMS. You disable it. What is the effect on encryption and decryption operations?

A Encryption and decryption both stop working immediately for that key.

B Both encryption and decryption continue to work until the key is destroyed.

C Encryption stops but decryption still works for existing ciphertexts.

D Decryption stops but encryption still works for new data.

💡 Hint

Think about how disabling a key affects new and existing data.

Disabling a CryptoKey prevents new encryption operations but allows decryption of existing ciphertexts. This ensures data can still be read but no new data can be encrypted with that key.

❓ Architecture

intermediate

Which Cloud KMS resource hierarchy is correct for managing keys securely?

Arrange the Cloud KMS resources from broadest to most specific for organizing keys securely.

A 2, 1, 3, 4

B 3, 1, 2, 4

C 2, 3, 1, 4

D 1, 2, 3, 4

💡 Hint

Think about how projects contain key rings and key rings contain keys.

The correct hierarchy is Project > Key Ring > CryptoKey > CryptoKey Version. Projects contain key rings, which group keys, and each key has versions.

❓ security

advanced

What is the effect of setting an IAM policy to deny 'cloudkms.cryptoKeyVersions.useToEncrypt' permission on a user?

You set an IAM policy that denies the 'cloudkms.cryptoKeyVersions.useToEncrypt' permission for a user on a CryptoKey. What will happen when the user tries to encrypt data?

A The user cannot encrypt data but can decrypt existing ciphertexts.

B The user can neither encrypt nor decrypt data.

C The user can encrypt data but cannot decrypt it.

D The user can encrypt and decrypt data as usual.

💡 Hint

Consider what the specific permission controls.

The 'useToEncrypt' permission controls the ability to encrypt data. Denying it prevents encryption but does not affect decryption permissions.

❓ Configuration

advanced

What is the output of this gcloud command to create a new CryptoKey with automatic rotation every 30 days?

Consider the following command:

gcloud kms keys create my-key --location=us-central1 --keyring=my-ring --purpose=encryption --rotation-period=2592000s --next-rotation-time=2024-07-01T00:00:00Z

What will be the rotation behavior of this key?

A The key will rotate once after 30 days from creation and then stop rotating.

B The key will not rotate automatically because next-rotation-time is in the past.

C The command will fail because rotation-period must be specified in days, not seconds.

D The key will rotate automatically every 30 days starting from 2024-07-01T00:00:00Z.

💡 Hint

Check the format and meaning of rotation-period and next-rotation-time.

The rotation-period is specified in seconds (2592000s = 30 days). The key will rotate automatically every 30 days starting at the specified next-rotation-time.

✅ Best Practice

expert

Which approach best ensures minimal exposure of plaintext keys in Cloud KMS usage?

You want to minimize the risk of exposing plaintext encryption keys in your application using Cloud KMS. Which approach is best?

A Store the plaintext key in your application and use Cloud KMS only to encrypt/decrypt data directly.

B Use Cloud KMS to generate and store keys, and perform all encryption and decryption operations inside Cloud KMS without exporting keys.

C Export the plaintext key from Cloud KMS and store it encrypted in your application for faster access.

D Use Cloud KMS only to encrypt the keys and perform encryption/decryption with plaintext keys in your app.

💡 Hint

Think about where the plaintext keys should reside to reduce risk.

Keeping keys inside Cloud KMS and performing cryptographic operations there avoids exposing plaintext keys to your application, reducing risk of leakage.