You need to ensure that data on Compute Engine disks is encrypted at rest using keys managed by Cloud Key Management Service (KMS). Additionally, Cloud IAM permissions for these keys must be managed collectively, as the same permissions apply to all keys. What should you do?

Exam-Like

Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the Key level.

Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the KeyRing level.

Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the Key level.

Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the KeyRing level.

Google Professional Cloud Security Engineer