A healthcare startup asks whether it must enable anything before data written to Cloud Storage is encrypted at rest. What is true?
Show answer and explanation
Answer: B
Google Cloud encrypts customer data at rest by default, and Google manages the data encryption keys through its internal key hierarchy, so no setup is required. The customer can still choose customer-managed keys in Cloud KMS for more control over rotation and revocation. Default encryption applies uniformly across storage services, including object storage.
Why the other options are wrong
- A. Encryption at rest is a platform-wide default that covers object storage as well as databases, so this statement is false.
- C. No agent is required. Encryption at rest is handled by the storage infrastructure itself, not by software a customer installs.
- D. Default encryption is not tied to specific regions or hardware clusters, so it applies wherever data is stored in Google Cloud.