Unlock the power of your data in the cloud! Get hands-on with Google Cloud's core data services like BigQuery and Looker to validate your practical skills in data ingestion, analysis, and management, and earn your Associate Data Practitioner certification!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A data engineering team needs to implement envelope encryption to protect sensitive data files stored across multiple client environments. The architecture requires that client applications encrypt a locally generated Data Encryption Key (DEK) without granting them direct access to decrypt data or manage the private key.
Which workflow correctly describes how Cloud KMS asymmetric keys should be used to protect the DEK?
Retrieve the public key from Cloud KMS to encrypt the DEK locally on client systems, and call Cloud KMS to decrypt the encrypted DEK using the private key when data access is needed.
Store the DEK permanently in Cloud KMS to directly encrypt raw dataset blocks, and perform key rotation by deleting older data tables.
Call the Cloud KMS API to encrypt large data files directly with the private key, and distribute the public key to client applications for local decryption.
Export the private key from Cloud KMS to encrypt the DEK locally on client systems, and use the public key in Cloud KMS to decrypt the DEK.
Retrieve the public key from Cloud KMS to encrypt the DEK locally on client systems, and call Cloud KMS to decrypt the encrypted DEK using the private key when data access is needed.
Asymmetric encryption in Google Cloud Key Management Service (Cloud KMS) uses a mathematically linked public and private key pair. In this model, the public key is made available to encrypt plaintext data, while the corresponding private key is kept secure within Cloud KMS and used exclusively for decryption operations.
StudyCerts
StudyCertsroles/cloudkms.publicKeyViewer), preventing them from decrypting data.This workflow allows decentralized encryption across numerous distributed clients without exposing sensitive decryption keys. It keeps private key material centralized and safeguarded within Cloud KMS while supporting high-throughput local data encryption.
Store the DEK permanently in Cloud KMS to directly encrypt raw dataset blocks, and perform key rotation by deleting older data tables.
Call the Cloud KMS API to encrypt large data files directly with the private key, and distribute the public key to client applications for local decryption.
Export the private key from Cloud KMS to encrypt the DEK locally on client systems, and use the public key in Cloud KMS to decrypt the DEK.