Objective 3.2
PCSEManaging encryption at rest, in transit, and in use
Objective 3.2 sits in Ensuring data protection, which carries 23% of the Cloud Security Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.
Objective title verbatim from the official objectives. Google Cloud exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An analyst reads a BigQuery table protected by a CMEK and holds no Cloud KMS role at all. Why does the read succeed?
Correct.
Concept
Placing the key permission on the service rather than on the reader keeps the access decision in one place. The reader is judged on the resource, and the platform handles the cryptography behind it.
Why C
A principal creating or viewing resources in a CMEK-integrated service does not require the Cloud KMS CryptoKey Encrypter/Decrypter role; the project service agent performs encryption and decryption instead.
Source
Google Cloud: Customer-managed encryption keys (CMEK), checked August 2026The principal that creates or views resources in the CMEK-integrated service does not require the Cloud KMS CryptoKey Encrypter/Decrypter ( roles/cloudkms.cryptoKeyEncrypterDecrypter ) for the CMEK used to protect the resource. Each project resource has a special service account called a service agent that performs encryption and decryption with customer-managed keys.
Now you: objective 3.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A compliance team asks whether other customers could share the key protecting data left on Google default encryption. What is the accurate response?
Sample question 2 of 3
A security engineer asks whether an imported CMEK could ever be exported from Google Cloud for use elsewhere. What does CMEK integration guarantee?
Sample question 3 of 3
A platform team enabling Cloud KMS Autokey wants every key for a folder to land in one nominated project. Which storage option does that?
Full Cloud Security Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.