One of your encryption keys stored in Cloud Key Management Service (Cloud KMS) was exposed. You need to re-encrypt all of your CMEK-protected Cloud Storage data that used that key, and then delete the compromised key. You also want to reduce the risk of objects getting written without customer-managed encryption key (CMEK) protection in the future. What should you do?

A Is not correct because existing data will not automatically be re-encrypted just by rotating the key. B is not correct because only newly written data will use the new key; existing data will still use the old key. C is not correct because although it works, similar to the correct answer, but doesn't reduce risk of writing objects without CMEK as requested in the question (since bucket default CMEK key not set). D Is correct because new bucket with CMEK will ensure that any data subsequently written to it (including the existing data being copied from the old bucket) will be protected with the default key.