Show you can work with data on Google Cloud, from ingesting and analyzing it with BigQuery and Looker to managing access, and track your readiness for the Associate Data Practitioner exam.

Fundamental

Prepare and test your skills

Fundamental

Prepare and test your skills

Google Cloud feature

CMEK

Topic in 4 exam domains

X LinkedIn Facebook Reddit

CMEK · Feature
CMEK · Concept

Also called: CMEK encryption keys, Customer Managed Encryption Key, customer-managed key, customer-managed storage encryption, customer-managed-encryption-key

Customer-managed encryption keys (CMEK) are customer-controlled keys used to protect and control access to data at rest across supported Google Cloud services. On Associate Data Practitioner it comes up as a key management strategy evaluated within the data management domain against default and customer-supplied options to meet compliance, access control, and auditing requirements.

What you can expect on the exam

Envelope encryption and access revocation. Be ready to understand how CMEK relies on envelope encryption to wrap data encryption keys, allowing administrators to halt data access and processing by revoking or disabling the key.
Evaluating encryption key management options. Expect to determine when to implement CMEK instead of alternative key models based on compliance demands, governance standards, and requirements for customer control over key rotation.
Securing compute and container workloads. Be prepared to understand how CMEK secures infrastructure resources by protecting Compute Engine persistent disks and GKE resources.

Where this appears on the exam

2 subdomains in 1 of 4 domains

Section 4
Data Management
1. 4.4Apply security measures and ensure compliance with data privacy regulations
  - Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)
  - Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys

How learners score on this topic

Last updated November 2, 2026

Associate Data Practitioner

Show you can work with data on Google Cloud, from ingesting and analyzing it with BigQuery and Looker to managing access, and track your readiness for the Associate Data Practitioner exam.

Fundamental

Prepare and test your skills

Fundamental

Prepare and test your skills

Google Cloud feature

CMEK

Topic in 4 exam domains

X LinkedIn Facebook Reddit

CMEK · Feature
CMEK · Concept

Also called: CMEK encryption keys, Customer Managed Encryption Key, customer-managed key, customer-managed storage encryption, customer-managed-encryption-key

What you can expect on the exam

Envelope encryption and access revocation. Be ready to understand how CMEK relies on envelope encryption to wrap data encryption keys, allowing administrators to halt data access and processing by revoking or disabling the key.
Evaluating encryption key management options. Expect to determine when to implement CMEK instead of alternative key models based on compliance demands, governance standards, and requirements for customer control over key rotation.
Securing compute and container workloads. Be prepared to understand how CMEK secures infrastructure resources by protecting Compute Engine persistent disks and GKE resources.

Where this appears on the exam

2 subdomains in 1 of 4 domains

Section 4
Data Management
1. 4.4Apply security measures and ensure compliance with data privacy regulations
  - Identify use cases for customer-managed encryption keys (CMEK), customer-supplied encryption keys (CSEK), and Google-managed encryption keys (GMEK)
  - Understand the role of Cloud Key Management Service (Cloud KMS) to manage encryption keys

How learners score on this topic

Last updated November 2, 2026

What you can expect on the exam

Where this appears on the exam

Related topics

How learners score on this topic

What you can expect on the exam

Where this appears on the exam

Related topics

How learners score on this topic