What should you do?

You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.

What should you do?
A . Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DE
B . Store both the encrypted data and the encrypted DE
D . Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DE
E . Store both the encrypted data and the KE
G . Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted
data and the encrypted DE
. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KE

Answer: A

Explanation:

Reference: https://cloud.google.com/kms/docs/envelope-encryption