Your company requires that all data stored in Cloud Storage be encrypted using keys managed by your security team. The security team wants to automatically rotate the keys every 90 days. Which encryption method should you use?

Customer-Managed Encryption Keys (CMEK) via Cloud KMS is the standard solution when a company needs control over key management (rotation, disabling, auditing) but wants GCP services (like Cloud Storage) to handle the actual encryption/decryption process seamlessly. Cloud KMS supports automatic key rotation.