A Compute Engine VM is running a critical database. To secure its private key from disk theft and comply with FIPS 140-2 Level 3, the key must be…

The core requirements are storing a private key in a dedicated hardware security module (HSM) and achieving FIPS 140-2 Level 3 compliance. Google Cloud HSM is the service designed specifically for these needs. It provides a fully managed, single-tenant HSM service that allows you to host encryption keys and perform cryptographic operations within a FIPS 140-2 Level 3 certified hardware appliance. This ensures that the key material never leaves the physical HSM, protecting it from threats like disk theft and meeting stringent compliance standards.

B. Cloud Identity and Access Management (IAM): IAM is a service for managing authorization and access control to Google Cloud resources. It does not provide cryptographic key storage or management capabilities.

C. Cloud Storage with CMEK: Customer-Managed Encryption Keys (CMEK) use Cloud KMS to protect data at rest in services like Cloud Storage. This option is incorrect because the primary need is to protect the database's private key, not data in Cloud Storage.

D. Cloud KMS (Software-backed key): While Cloud KMS is a key management service, its software-backed keys are validated at FIPS 140-2 Level 1. This does not meet the explicit requirement for Level 3 compliance or storage in a dedicated hardware module.

1. Google Cloud Documentation, "Cloud HSM overview": "Cloud HSM is a cloud-hosted hardware security module (HSM) service that allows you to host encryption keys and perform cryptographic operations in a cluster of FIPS 140-2 Level 3 certified HSMs." (Source: Google Cloud, Cloud HSM Documentation, Overview section, Paragraph 1).

2. Google Cloud Documentation, "Cloud Key Management Service documentation - Protection levels": This document details the different protection levels available in Cloud KMS. It specifies that HSM protection level keys are stored in a hardware security module and that "Cloud HSM provides FIPS 140-2 Level 3 validation." In contrast, it states that SOFTWARE protection level keys are "validated at FIPS 140-2 Level 1." (Source: Google Cloud, Cloud KMS Documentation, Concepts, Protection levels section).

3. Google Cloud Documentation, "Compliance offerings": This resource lists Google Cloud's compliance with various standards. Under FIPS 140-2, it explicitly lists Cloud HSM as "Validated at Level 3". (Source: Google Cloud, Security, Compliance Offerings, FIPS 140-2 section).