Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
Cloud EKM
Topic in 5 exam domains
Google Cloud External Key Manager, allowing external keys to be used within CMEK policies.
Where this appears on the exam
4 objectives in 2 of 5 domains
Related topics
This topicBuilds on theseBuilds on theseBuilds on theseApplied
Cloud EKMService
Application Default CredentialsFeatureKey Access JustificationsFeatureSpannerServiceCloud KMSServiceKnowledge CatalogServiceCloud Key Management ServiceServicecustomer-managed encryption keysFeatureCloud External Key ManagerServiceCloud HSMServiceBigQueryServiceCloud SQLServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Cloud EKM works with customer-managed encryption keys From the official documentation: “You can also use an Cloud EKM key as a CMEK for encryption and decryption.”
- Cloud EKM works with Cloud Key Management Service From the official documentation: “You can use an [externally managed key](/kms/docs/ekm) with CMEK using the Cloud EKM service to make the key available through Cloud KMS.”
- Cloud EKM works with Cloud KMS From the official documentation: “To learn how to use external keys with Cloud Key Management Service, see [Cloud External Key Manager](/kms/docs/ekm).”
- Cloud EKM works with Key Access Justifications From the official documentation: “[Key Access Justifications](https://cloud.google.com/blog/products/identity-security/control-access-to-gcp-data-with-key-access-justifications) integrate with Cloud KMS and Cloud EKM.”
- Cloud EKM works with Knowledge Catalog From the official documentation: “Knowledge Catalog supports Cloud KMS keys, Cloud HSM keys, and Cloud External Key Manager keys.”
- Key Access Justifications is part of Cloud EKM From the official documentation: “You can use Key Access Justifications as part of Cloud EKM.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Application Default Credentials secures Spanner From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- Knowledge Catalog depends on Application Default Credentials From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- Application Default Credentials works with Spanner From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- BigQuery works with Knowledge Catalog From the official documentation: “Some Knowledge Catalog functionalities trigger job execution using BigQuery.”
- customer-managed encryption keys depends on Cloud KMS From the official documentation: “You must have a symmetric encryption key in Cloud KMS to use for CMEK.”
- Spanner depends on Application Default Credentials From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- Application Default Credentials works with Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- Cloud KMS depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- BigQuery works with Spanner From the official documentation: “Reverse ETL (BigQuery to Spanner)”
- Cloud SQL works with Knowledge Catalog From the official documentation: “You can use Knowledge Catalog to organize and enrich the metadata of Cloud SQL resources.”
- Cloud External Key Manager works with Key Access Justifications From the official documentation: “If you [use a Cloud EKM key](/alloydb/docs/cmek#ekm), then you can use Key Access Justifications to view the reason for each Cloud EKM request.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- customer-managed encryption keys secures Cloud SQL From the official documentation: “Enable CMEK for Cloud SQL Databases”
- Application Default Credentials secures Knowledge Catalog From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- Key Access Justifications is part of Cloud External Key Manager From the official documentation: “You can use Key Access Justifications as part of Cloud EKM.”
- Application Default Credentials works with Cloud Key Management Service From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with Knowledge Catalog From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- Cloud KMS works with customer-managed encryption keys From the official documentation: “With customer-managed encryption keys (CMEK), volume keys are wrapped using your keys stored in Cloud KMS.”
- BigQuery works with Cloud Key Management Service From the official documentation: “Change the Cloud KMS key for a BigQuery table”
- Cloud HSM is part of Cloud Key Management Service From the official documentation: “You can import into Multi-tenant Cloud HSM keys, Single-tenant Cloud HSM keys, or software keys in Cloud KMS.”
- Cloud Key Management Service works with Cloud SQL From the official documentation: “Cloud KMS integrates with Cloud SQL.”
- customer-managed encryption keys is part of Cloud Key Management Service From the official documentation: “The Cloud KMS keys that you create are customer-managed keys.”
- customer-managed encryption keys is part of Cloud KMS From the official documentation: “To protect your agents' data by using encryption keys that you control,<br>you can use [CMEKs](/kms/docs/cmek)<br>that you create and manage in Cloud KMS.”
- customer-managed encryption keys works with Spanner From the official documentation: “This page describes how to use manually-created customer-managed encryption keys (CMEK) for Spanner.”
- BigQuery works with Cloud KMS From the official documentation: “# Enable the BigQuery service account to encrypt/decrypt Cloud KMS keys”
- Cloud Key Management Service depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Key Management Service secures BigQuery From the official documentation: “You can encrypt data at the dataset or project level with the default customer-managed Cloud Key Management Service keys in BigQuery.”
- Cloud Key Management Service is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud KMS works with Key Access Justifications From the official documentation: “Key Access Justifications enable control over viewing and approving key access<br>requests in Cloud KMS or [certain external key<br>management partners](/kms/docs/ekm#compatibility).”
- Key Access Justifications configures Cloud Key Management Service From the official documentation: “[Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview) lets you set a policy on Cloud KMS keys to view, approve, and deny key access requests depending on the provided justification code.”
- Application Default Credentials configures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials secures Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with Cloud SQL From the official documentation: “Application Default Credentials are part of the client libraries you can use to access Cloud SQL.”
- Application Default Credentials configures Knowledge Catalog From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- Cloud External Key Manager is part of Cloud Key Management Service From the official documentation: “In addition to these features, the Assured Workloads control package you choose will also determine which of the following Cloud KMS key types are available: - [Cloud EKM keys](/kms/docs/ekm#overview)”
- Cloud External Key Manager works with Cloud Key Management Service From the official documentation: “You can use an externally managed key with CMEK using the Cloud External Key Manager service to [make the key available](/kms/docs/ekm) through Cloud KMS.”
- Cloud External Key Manager is an alternative to Cloud Key Management Service From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud External Key Manager secures Cloud SQL From the official documentation: “To protect data in Cloud SQL instances, you can use keys that you manage within a supported external key management partner. For more information, see [Cloud External Key Manager](/kms/docs/ekm), including the [Considerations](/kms/docs/ekm#considerations) section.”
- Cloud External Key Manager is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud External Key Manager works with Knowledge Catalog From the official documentation: “In addition, Knowledge Catalog supports Cloud External Key Manager (Cloud EKM), which lets you store your keys in an external key manager outside of Google Cloud.”
- Cloud External Key Manager works with Spanner From the official documentation: “In addition, Spanner supports Cloud External Key Manager (Cloud EKM), which lets you store your keys in an external key manager outside of Google Cloud.”
- Cloud HSM depends on Cloud Key Management Service From the official documentation: “Because Cloud HSM uses Cloud KMS as its front end, you can leverage all the conveniences and features that Cloud KMS provides.”
- Cloud HSM works with Cloud Key Management Service From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud HSM works with Cloud KMS From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud HSM works with Key Access Justifications From the official documentation: “To configure Key Access Justifications with a Cloud KMS or Cloud HSM key, you can either include the key access policy as a parameter when you create the key, or you can update the key with the policy after the key has been created.”
- Cloud HSM works with Knowledge Catalog From the official documentation: “Knowledge Catalog supports Cloud KMS keys, Cloud HSM keys, and Cloud External Key Manager keys.”
- Cloud Key Management Service works with Key Access Justifications From the official documentation: “[Key Access Justifications](https://cloud.google.com/blog/products/identity-security/control-access-to-gcp-data-with-key-access-justifications) integrate with Cloud KMS and Cloud EKM.”
- Cloud Key Management Service depends on Spanner From the official documentation: “Cloud KMS stores all of its data and metadata in Spanner databases which provide high data durability and availability with synchronous replication.”
How learners score on this topic
Last updated