A bank runs a BigQuery dataset of transaction records that must be encrypted with keys the bank controls, rotated on a fixed schedule, and destroyable on request, while a separate security team alone administers those keys and the analytics engineers who query the data must never be able to disable, rotate, or destroy a key. Which TWO controls together enforce both the customer-controlled encryption requirement and the separation of key administration from data access? (Select TWO.)
- ACreate the BigQuery dataset with a customer-managed encryption key from a Cloud KMS key ring, and configure a key rotation period on that key so new key versions are generated automatically on the required schedule. Correct
- BRely on Google-managed default encryption for the dataset and document the rotation behaviour in the data protection policy, since all BigQuery data is encrypted at rest regardless of key ownership.
- CGrant the security team the Cloud KMS Admin role on the key ring and grant the analytics engineers only the Cloud KMS CryptoKey Encrypter/Decrypter role, so engineers can use the key for queries but cannot manage its lifecycle. Correct
- DGive the analytics engineers the Cloud KMS Admin role on the key ring so their queries can transparently use the key without a separate grant, and audit their usage with Cloud Audit Logs.
- EApply customer-supplied encryption keys to the BigQuery dataset and store the raw key material in a Secret Manager secret that the analytics engineers read at query time.
Why A is correct: Correct because a customer-managed encryption key places key lifecycle, scheduled rotation, and destruction under the bank's control rather than relying on Google-managed defaults, which directly satisfies the requirement that the bank own and be able to destroy the encryption key.
Why B is wrong: Tempting because BigQuery does encrypt all data at rest by default, but Google-managed keys cannot be rotated on the bank's schedule or destroyed on demand by the customer, so this fails the customer-control and per-request destruction requirements entirely.
Why C is correct: Correct because splitting the administrative role from the encrypt/decrypt role enforces separation of duties: the security team manages rotation and destruction while engineers hold only the permission needed to read and write data, never to disable or destroy a key.
Why D is wrong: Tempting because granting a broad role removes a permissions hurdle for queries, but Cloud KMS Admin allows disabling, rotating, and destroying keys, which violates the explicit requirement that engineers must never be able to manage key lifecycle.
Why E is wrong: Tempting because customer-supplied keys also give the customer control of key material, but BigQuery datasets do not accept customer-supplied encryption keys, and exposing raw key material to engineers would defeat the separation of key administration the scenario demands.