A regulated firm requires every new Compute Engine persistent disk to be protected by a customer-managed key. Prevention matters more than cleanup, so non-compliant disks must never be created. Which control achieves this?
Show answer and explanation
Answer: C
The gcp.restrictNonCmekServices constraint, when it lists compute.googleapis.com, causes creation requests for supported Compute Engine resources without a customer-managed key to be rejected. The block happens at creation time, so unprotected disks never exist. This matches the prevention goal, and the constraint applies across the hierarchy beneath the level where it is set.
Why the other options are wrong
- A. A cleanup job reacts after creation, so non-compliant disks exist until the next run and may hold sensitive data in the meantime. Deleting them can also destroy data that was needed.
- B. Google-managed default encryption is used precisely when no key is specified. It is the non-compliant case the policy must prevent, not a safeguard against it.
- D. Deny policies match on identity and resource conditions, not on whether a disk has a key set. Blocking the permission would stop all disk creation rather than enforce the key requirement.