Cloud KMS for key management in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when you disable a CryptoKey in Cloud KMS?

You have a CryptoKey in Google Cloud KMS. You disable it. What is the effect on encryption and decryption operations?

A Encryption and decryption both stop working immediately for that key.

B Both encryption and decryption continue to work until the key is destroyed.

C Encryption stops but decryption still works for existing ciphertexts.

D Decryption stops but encryption still works for new data.

💡 Hint

Think about how disabling a key affects new and existing data.

Disabling a CryptoKey prevents new encryption operations but allows decryption of existing ciphertexts. This ensures data can still be read but no new data can be encrypted with that key.

❓ Architecture

intermediate

Which Cloud KMS resource hierarchy is correct for managing keys securely?

Arrange the Cloud KMS resources from broadest to most specific for organizing keys securely.

A 2, 1, 3, 4

B 3, 1, 2, 4

C 2, 3, 1, 4

D 1, 2, 3, 4

💡 Hint

Think about how projects contain key rings and key rings contain keys.

The correct hierarchy is Project > Key Ring > CryptoKey > CryptoKey Version. Projects contain key rings, which group keys, and each key has versions.

❓ security

advanced

What is the effect of setting an IAM policy to deny 'cloudkms.cryptoKeyVersions.useToEncrypt' permission on a user?

You set an IAM policy that denies the 'cloudkms.cryptoKeyVersions.useToEncrypt' permission for a user on a CryptoKey. What will happen when the user tries to encrypt data?

A The user cannot encrypt data but can decrypt existing ciphertexts.

B The user can neither encrypt nor decrypt data.

C The user can encrypt data but cannot decrypt it.

D The user can encrypt and decrypt data as usual.

💡 Hint

Consider what the specific permission controls.

The 'useToEncrypt' permission controls the ability to encrypt data. Denying it prevents encryption but does not affect decryption permissions.

❓ Configuration

advanced

What is the output of this gcloud command to create a new CryptoKey with automatic rotation every 30 days?

Consider the following command:

gcloud kms keys create my-key --location=us-central1 --keyring=my-ring --purpose=encryption --rotation-period=2592000s --next-rotation-time=2024-07-01T00:00:00Z

What will be the rotation behavior of this key?

A The key will rotate once after 30 days from creation and then stop rotating.

B The key will not rotate automatically because next-rotation-time is in the past.

C The command will fail because rotation-period must be specified in days, not seconds.

D The key will rotate automatically every 30 days starting from 2024-07-01T00:00:00Z.

💡 Hint

Check the format and meaning of rotation-period and next-rotation-time.

The rotation-period is specified in seconds (2592000s = 30 days). The key will rotate automatically every 30 days starting at the specified next-rotation-time.

✅ Best Practice

expert

Which approach best ensures minimal exposure of plaintext keys in Cloud KMS usage?

You want to minimize the risk of exposing plaintext encryption keys in your application using Cloud KMS. Which approach is best?

A Store the plaintext key in your application and use Cloud KMS only to encrypt/decrypt data directly.

B Use Cloud KMS to generate and store keys, and perform all encryption and decryption operations inside Cloud KMS without exporting keys.

C Export the plaintext key from Cloud KMS and store it encrypted in your application for faster access.

D Use Cloud KMS only to encrypt the keys and perform encryption/decryption with plaintext keys in your app.

💡 Hint

Think about where the plaintext keys should reside to reduce risk.

Keeping keys inside Cloud KMS and performing cryptographic operations there avoids exposing plaintext keys to your application, reducing risk of leakage.

Practice

1. What is the main purpose of Google Cloud KMS (Key Management Service)?

easy

A. To securely store and manage encryption keys

B. To host virtual machines

C. To manage user identities

D. To monitor network traffic

Solution

1. Step 1: Understand the role of Cloud KMS

   Cloud KMS is designed to store and manage encryption keys securely in the cloud.

2. Step 2: Compare with other services

   Hosting virtual machines, managing identities, and monitoring traffic are handled by other GCP services, not KMS.

3. Final Answer:

   To securely store and manage encryption keys -> Option A

4. Quick Check:

   Cloud KMS = key management [OK]

Hint: Cloud KMS is about keys, not machines or users [OK]

Common Mistakes:

• Confusing KMS with Compute Engine
• Thinking KMS manages users
• Assuming KMS monitors networks

2. Which of the following is the correct command to create a key ring named my-key-ring in location us-central1 using gcloud CLI?

easy

A. gcloud kms keyrings create my-key-ring --location=us-central1

B. gcloud kms create keyring my-key-ring --region=us-central1

C. gcloud kms keyrings new my-key-ring --location=us-central1

D. gcloud kms keyring create my-key-ring --zone=us-central1

Solution

1. Step 1: Recall gcloud syntax for key ring creation

   The correct command uses 'gcloud kms keyrings create' with the --location flag.

2. Step 2: Verify option details

   gcloud kms keyrings create my-key-ring --location=us-central1 matches the correct syntax and uses the correct flag '--location=us-central1'. Other options use wrong verbs or flags.

3. Final Answer:

   gcloud kms keyrings create my-key-ring --location=us-central1 -> Option A

4. Quick Check:

   Correct gcloud syntax = gcloud kms keyrings create my-key-ring --location=us-central1 [OK]

Hint: Use 'keyrings create' with --location flag for key rings [OK]

Common Mistakes:

• Using --region instead of --location
• Wrong command order like 'create keyring'
• Using --zone which is for compute resources

3. Given the following Python snippet using Google Cloud KMS client, what will be the output if the key does not exist?

from google.cloud import kms_v1
client = kms_v1.KeyManagementServiceClient()
key_name = client.crypto_key_path('my-project', 'us-central1', 'my-key-ring', 'nonexistent-key')
response = client.get_crypto_key(request={'name': key_name})
print(response.name)

medium

A. Prints the key name string

B. Raises a NotFound exception

C. Prints None

D. Returns an empty response object

Solution

1. Step 1: Understand get_crypto_key behavior

   When requesting a key that does not exist, the client raises a NotFound error.

2. Step 2: Check the code flow

   The code calls get_crypto_key with a nonexistent key name, so it will not print but raise an exception.

3. Final Answer:

   Raises a NotFound exception -> Option B

4. Quick Check:

   Missing key triggers NotFound error [OK]

Hint: Missing keys cause NotFound exceptions, not None [OK]

Common Mistakes:

• Assuming it prints the key name anyway
• Expecting None instead of error
• Thinking it returns empty object

4. You try to rotate a key in Cloud KMS using the command:

gcloud kms keys rotate my-key --keyring=my-key-ring --location=us-central1

But you get an error. What is the most likely cause?

medium

A. The key is already rotated

B. The location flag is misspelled

C. The key ring does not exist

D. The key does not have rotation policy set

Solution

1. Step 1: Understand prerequisites for key rotation

   The keyring must exist in the specified location before you can perform operations like rotating a key in it.

2. Step 2: Analyze the error cause

   If the key ring does not exist, the command fails with a resource not found error. Manual rotation does not require a rotation policy, the location flag is correct, and keys can be rotated multiple times.

3. Final Answer:

   The key ring does not exist -> Option C

4. Quick Check:

   Keyring must exist for key rotation [OK]

Hint: Create keyring before rotating keys [OK]

Common Mistakes:

• Thinking rotation policy is required
• Believing key can't be rotated if already rotated
• Assuming location flag typo

5. You want to ensure your encryption keys in Cloud KMS are rotated automatically every 30 days. Which configuration should you apply to the key to achieve this?

hard

A. Set the key ring's location to a region that supports auto-rotation

B. Manually run the rotate command every 30 days

C. Create a new key every 30 days and delete the old one

D. Set the key's rotation period to 30 days using the --rotation-period flag

Solution

1. Step 1: Understand automatic rotation in Cloud KMS

   Automatic rotation is configured by setting the key's rotation period property.

2. Step 2: Evaluate options

   Set the key's rotation period to 30 days using the --rotation-period flag correctly sets the rotation period. Manual rotation or creating new keys are manual processes. Location does not control rotation.

3. Final Answer:

   Set the key's rotation period to 30 days using the --rotation-period flag -> Option D

4. Quick Check:

   Rotation period config enables automatic key rotation [OK]

Hint: Use --rotation-period to automate key rotation [OK]

Common Mistakes:

• Relying on manual rotation only
• Confusing key ring location with rotation
• Deleting and recreating keys unnecessarily