Which IAM role is required for a user to just use a key to encrypt or decrypt data, but NOT manage the key itself?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Cloud KMS CryptoKey Encrypter/Decrypter

This role is following the principle of least privilege for application identities....

📋Part of Associate Cloud Engineer · GCP Certification Practice

Real Exam ScenarioCloud Key Management Service

Which IAM role is required for a user to just use a key to encrypt or decrypt data, but NOT manage the key itself?

✓ Correct Answer & ExplanationCloud Key Management Service

Correct Answer

Cloud KMS CryptoKey Encrypter/Decrypter

Why This Answer Is Correct

This role is following the principle of least privilege for application identities.

📚 What This Question Tests

This question evaluates your knowledge of Cloud Key Management Service — a core concept tested in Associate Cloud Engineer. Understanding Cloud Key Management Service is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Associate Cloud Engineer Questions →Browse All GCP Exams →

Which IAM role is required for a user to just use a key to encrypt or decrypt data, but NOT manage the key itself?

Which IAM role is required for a user to just use a key to encrypt or decrypt data, but NOT manage the key itself?

📚 What This Question Tests

More Cloud Key Management Service Practice Questions