Home Microsoft Exams Google Cloud Exams Pricing

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Features

Readiness assessment
Practice tests
Focused practice
Explanations & AI tutor
Study guides & quizzes

Compare

vs Tutorials Dojo
vs Whizlabs
All comparisons

Terms Privacy CookiesSecurity About Pricing

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider. All questions and study content are original practice material and are not actual exam questions.

Home
Google Cloud Exams
GCP
Associate Data Practitioner
Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys
CMEK Setup in 4 Steps to Active Use

Diagram

CMEK Setup in 4 Steps to Active Use

X LinkedIn Facebook Reddit

A left-to-right process flow showing four CMEK setup steps from key ring to resource, leading to an active state where the service agent handles encryption.

In the Domain

How CMEK Integrates with Google Cloud Data Services

Manually enabling CMEK follows an ordered workflow where the key and its permission must exist before the protected resource can use them:

Create or choose a key ring: Create a Cloud KMS key ring near the resources you will protect, in the same project or a separate project for separation of duties.
Create or import the key: Create or import a Cloud KMS key in that key ring to serve as the CMEK.
Grant the service agent access: Grant the service's service account the CryptoKey Encrypter/Decrypter IAM role on the CMEK.
Configure the resource to use the CMEK: Select the CMEK when creating the resource, such as a BigQuery table protected at rest by that key.

Read it in the Domain summary

Domain 2 of 3

Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys

Read the Domain summary

Practice this Domain

30 practice questions

Practice this Domain

Last updated October 23, 2026

Domain 2 of 3

Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys

Read the Domain summary

Practice this Domain

30 practice questions

Practice this Domain

Practice questions in this domain

1.A data engineering team needs to implement envelope encryption to protect sensitive data files stored across multiple client environments. The architecture requires that client applications encrypt a locally generated Data Encryption Key (DEK) without granting them direct access to decrypt data or manage the private key. Which workflow correctly describes how Cloud KMS asymmetric keys should be used to protect the DEK?
2.An enterprise is storing sensitive customer analytics datasets across Google Cloud storage and data services, such as BigQuery and Cloud Storage. While Google Cloud encrypts all data at rest by default, the company's regulatory compliance mandate requires the security team to maintain direct control over key rotation schedules, audit key usage, and immediately revoke access to data by disabling keys if a security incident occurs. Which encryption strategy should the organization implement to meet these compliance requirements?
3.An organization is designing an encryption management architecture in Google Cloud to protect sensitive analytics datasets in accordance with compliance standards. The security team has defined the following operational requirements: Keys must be logically organized and bound to a specific Google Cloud region. Access permissions must be managed efficiently across a collection of related keys using Identity and Access Management (IAM). Keys must undergo periodic rotation without compromising the ability to decrypt historical records that were encrypted with earlier key material. Which architectural configuration in Cloud Key Management Service (Cloud KMS) correctly fulfills these requirements?

Loading page

Home
Google Cloud Exams
GCP
Associate Data Practitioner
Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys
CMEK Setup in 4 Steps to Active Use

Diagram

CMEK Setup in 4 Steps to Active Use

X LinkedIn Facebook Reddit

In the Domain

How CMEK Integrates with Google Cloud Data Services

Manually enabling CMEK follows an ordered workflow where the key and its permission must exist before the protected resource can use them:

Create or choose a key ring: Create a Cloud KMS key ring near the resources you will protect, in the same project or a separate project for separation of duties.
Create or import the key: Create or import a Cloud KMS key in that key ring to serve as the CMEK.
Grant the service agent access: Grant the service's service account the CryptoKey Encrypter/Decrypter IAM role on the CMEK.
Configure the resource to use the CMEK: Select the CMEK when creating the resource, such as a BigQuery table protected at rest by that key.

Read it in the Domain summary

Domain 2 of 3

Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys

Read the Domain summary

Practice this Domain

30 practice questions

Practice this Domain

Last updated October 23, 2026

Domain 2 of 3

Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys

Read the Domain summary

Practice this Domain

30 practice questions

Practice this Domain

Practice questions in this domain

1.A data engineering team needs to implement envelope encryption to protect sensitive data files stored across multiple client environments. The architecture requires that client applications encrypt a locally generated Data Encryption Key (DEK) without granting them direct access to decrypt data or manage the private key. Which workflow correctly describes how Cloud KMS asymmetric keys should be used to protect the DEK?
2.An enterprise is storing sensitive customer analytics datasets across Google Cloud storage and data services, such as BigQuery and Cloud Storage. While Google Cloud encrypts all data at rest by default, the company's regulatory compliance mandate requires the security team to maintain direct control over key rotation schedules, audit key usage, and immediately revoke access to data by disabling keys if a security incident occurs. Which encryption strategy should the organization implement to meet these compliance requirements?
3.An organization is designing an encryption management architecture in Google Cloud to protect sensitive analytics datasets in accordance with compliance standards. The security team has defined the following operational requirements: Keys must be logically organized and bound to a specific Google Cloud region. Access permissions must be managed efficiently across a collection of related keys using Identity and Access Management (IAM). Keys must undergo periodic rotation without compromising the ability to decrypt historical records that were encrypted with earlier key material. Which architectural configuration in Cloud Key Management Service (Cloud KMS) correctly fulfills these requirements?