GCP PCA · Question 27 · Security Design

A healthcare company requires that all data stored in Cloud Storage must be encrypted using cryptographic keys that the company generates, stores, and manages entirely on their own on-premises Hardware Security Modules (HSMs). Google must not have access to the key material. Which encryption strategy must be used?