A government agency must keep its encryption keys in its own on-premises key management system, and Google Cloud services must use those keys without the key material ever being stored in Google Cloud. Which option meets this requirement?
Show answer and explanation
Answer: A
External Key Manager lets Google Cloud services use keys that remain in a supported external key management system operated by the customer. Google never holds the key material; for each cryptographic request, the service calls out to the external system. This supports key residency and sovereignty requirements. HSM and software protection levels keep keys inside Cloud KMS, and importing a key transfers its material into Cloud KMS, so none of them keeps the key outside Google Cloud.
Why the other options are wrong
- B. The HSM protection level stores keys in Cloud HSM inside Google Cloud. That gives hardware assurance, but the key material is held within Google's infrastructure rather than the agency's own key manager.
- C. The software protection level keeps keys in Cloud KMS with Google-managed software protection. It does not place the key material in an external system the agency controls.
- D. Key import uploads customer-generated key material into Cloud KMS. After import the key lives inside Google Cloud, so it does not satisfy a requirement that the key never reside there.