You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer. What should you do?
A) Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
B) Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
C) Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
D) Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.

Question

Quizplus · Accepted Answer

Envelope encryption involves encrypting data with a DEK and then encrypting the DEK with a KEK. The recommended practice is to generate the DEK locally, encrypt the data, and then use a KEK from Cloud KMS to encrypt the DEK. Both the encrypted data and the encrypted DEK should be stored.

You Need to Follow Google-Recommended Practices to Leverage Envelope Encryption