A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys. Which boot disk encryption solution should you use on the cluster to meet this customer’s requirements?

Customer-managed encryption keys (CMEK) allow the customer to control and manage the keys used to protect their data in Google Cloud services, including Compute Engine persistent disks. By using Cloud KMS, the customer can create, rotate, and destroy the keys, fulfilling the management requirement. CMEK is fully integrated with Managed Instance Groups (MIGs), supporting the use of auto-scaling for bursty workloads without the operational complexity or limitations of other methods. This solution provides the required key management capabilities while leveraging the native, high-performance features of Google Cloud.

A. Customer-supplied encryption keys (CSEK) are not supported for Managed Instance Groups (MIGs), making this option technically infeasible for the described architecture.
C. Encryption by default uses Google-managed keys. This does not meet the customer's requirement to be able to manage and rotate the encryption keys themselves.
D. Pre-encrypting files is a form of client-side encryption. It does not address the requirement to encrypt the entire boot disk, which is a block-level encryption task.

1. Google Cloud Documentation, "Customer-managed encryption keys (CMEK)". "With CMEK, you can use keys that you manage in Cloud Key Management Service to protect data at rest in Google Cloud services." and "CMEK is available for... Compute Engine".

2. Google Cloud Documentation, "Customer-supplied encryption keys (CSEK)". Under the "Restrictions" section, it explicitly states: "You can't use customer-supplied encryption keys with... Managed instance groups."

3. Google Cloud Documentation, "About Google Cloud encryption at rest". "By default, Google Cloud encrypts all data at rest... without any action required from you." This highlights that the customer does not manage these keys.