Home Microsoft Exams Google Cloud Exams Pricing

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Features

Readiness assessment
Practice tests
Focused practice
Explanations & AI tutor
Study guides & quizzes

Compare

vs Tutorials Dojo
vs Whizlabs
All comparisons

Terms Privacy CookiesSecurity About Pricing

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider. All questions and study content are original practice material and are not actual exam questions.

Home
Google Cloud Exams
GCP
Associate Data Practitioner
Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)
CMEK Envelope Encryption, Step by Step

Diagram

CMEK Envelope Encryption, Step by Step

X LinkedIn Facebook Reddit

A sequence diagram showing a CMEK-integrated service reading an encrypted chunk and wrapped DEK from storage, sending the wrapped DEK to Cloud KMS, receiving the unwrapped DEK while the customer-owned KEK never leaves KMS, and using the DEK to decrypt the data chunk. Steps reveal in order, with a caution that disabling the key blocks access.

In the Domain

Customer-Managed Keys for Control and Compliance Needs

Customer-managed encryption keys (CMEK) are Cloud KMS keys that the customer controls and uses with CMEK-integrated services such as Filestore and Google SecOps. CMEK uses envelope encryption, where the service generates a data encryption key (DEK) to encrypt the data and the customer's KEK in Cloud KMS wraps, or encrypts, that DEK. Because the service depends on Cloud KMS to unwrap the DEK on every access, revoking or disabling the CMEK blocks the service from reading, writing, ingesting, or processing data.

Read it in the Domain summary

Domain 1 of 3

Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)

Read the Domain summary

Practice this Domain

27 practice questions

Practice this Domain

Last updated October 23, 2026

Domain 1 of 3

Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)

Read the Domain summary

Practice this Domain

27 practice questions

Practice this Domain

Practice questions in this domain

1.An enterprise is planning to store sensitive analytics data in Google Cloud Storage and BigQuery. The security and compliance team establishes the following operational and governance requirements: The organization must retain control over the encryption key lifecycle, including defining automatic rotation schedules and immediately revoking key access to make data unreadable. The operations team wants to avoid managing dedicated on-premises hardware security modules (HSMs) or passing raw cryptographic keys with every API request. Cryptographic keys must be generated, stored, and managed natively within Google Cloud. Which encryption key management strategy should the organization implement?
2.A financial services organization is designing a data storage architecture on Google Cloud to store sensitive transaction records. The organization's security policy defines the following compliance and operational requirements: The organization must retain administrative control over encryption key lifecycle actions, including setting automatic rotation schedules and immediately disabling access to keys when necessary. Security administrators must be able to enforce key usage and restrict key locations centrally using Google Cloud organization policies. Native Google Cloud services must seamlessly integrate with the key management solution without requiring the organization to store or transmit raw cryptographic keys in individual API requests. Which encryption key management approach should the organization implement?
3.A financial services organization is designing a data storage architecture on Google Cloud. The company's compliance policy mandates that the security team must maintain direct administrative control over encryption key lifecycles—including key creation, rotation schedules, and immediate key revocation—directly through Google Cloud's centralized key management service, while allowing cloud storage services to automatically handle encryption and decryption operations. Which encryption key management strategy should the organization implement?

Loading page

Home
Google Cloud Exams
GCP
Associate Data Practitioner
Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)
CMEK Envelope Encryption, Step by Step

Diagram

CMEK Envelope Encryption, Step by Step

X LinkedIn Facebook Reddit

In the Domain

Customer-Managed Keys for Control and Compliance Needs

Customer-managed encryption keys (CMEK) are Cloud KMS keys that the customer controls and uses with CMEK-integrated services such as Filestore and Google SecOps. CMEK uses envelope encryption, where the service generates a data encryption key (DEK) to encrypt the data and the customer's KEK in Cloud KMS wraps, or encrypts, that DEK. Because the service depends on Cloud KMS to unwrap the DEK on every access, revoking or disabling the CMEK blocks the service from reading, writing, ingesting, or processing data.

Read it in the Domain summary

Domain 1 of 3

Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)

Read the Domain summary

Practice this Domain

27 practice questions

Practice this Domain

Last updated October 23, 2026

Domain 1 of 3

Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)

Read the Domain summary

Practice this Domain

27 practice questions

Practice this Domain

Practice questions in this domain

1.An enterprise is planning to store sensitive analytics data in Google Cloud Storage and BigQuery. The security and compliance team establishes the following operational and governance requirements: The organization must retain control over the encryption key lifecycle, including defining automatic rotation schedules and immediately revoking key access to make data unreadable. The operations team wants to avoid managing dedicated on-premises hardware security modules (HSMs) or passing raw cryptographic keys with every API request. Cryptographic keys must be generated, stored, and managed natively within Google Cloud. Which encryption key management strategy should the organization implement?
2.A financial services organization is designing a data storage architecture on Google Cloud to store sensitive transaction records. The organization's security policy defines the following compliance and operational requirements: The organization must retain administrative control over encryption key lifecycle actions, including setting automatic rotation schedules and immediately disabling access to keys when necessary. Security administrators must be able to enforce key usage and restrict key locations centrally using Google Cloud organization policies. Native Google Cloud services must seamlessly integrate with the key management solution without requiring the organization to store or transmit raw cryptographic keys in individual API requests. Which encryption key management approach should the organization implement?
3.A financial services organization is designing a data storage architecture on Google Cloud. The company's compliance policy mandates that the security team must maintain direct administrative control over encryption key lifecycles—including key creation, rotation schedules, and immediate key revocation—directly through Google Cloud's centralized key management service, while allowing cloud storage services to automatically handle encryption and decryption operations. Which encryption key management strategy should the organization implement?