Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
Cloud KMS
Topic in 10 exam domains
Also called: CloudKMS, customer-managed Cloud KMS
A Google Cloud key management service used to encrypt (wrap) cryptographic keys such as AES-256 keys.
Where this appears on the exam
8 objectives in 3 of 5 domains
~22% of exam
~25% of exam
~15% of exam
Related topics
FoundationsThis topicWorks alongsideBuilds on theseBuilds on theseAppliedApplication Default CredentialsFeatureKey Access JustificationsFeatureCloud Key Management ServiceServiceCloud MonitoringServiceKnowledge CatalogService
Cloud KMSService
Cloud LoggingServiceWorkflowsServiceCloud Asset InventoryServiceCloud Audit LogsServiceCloud BuildServiceCloud EKMServiceCloud HSMServiceGoogle Cloud StorageServicecustomer-managed encryption keysFeatureBigQueryServicePub/SubServiceCloud StorageServiceCloud RunServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- customer-managed encryption keys depends on Cloud KMS From the official documentation: “You must have a symmetric encryption key in Cloud KMS to use for CMEK.”
- Application Default Credentials works with Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud KMS depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud KMS works with customer-managed encryption keys From the official documentation: “With customer-managed encryption keys (CMEK), volume keys are wrapped using your keys stored in Cloud KMS.”
- customer-managed encryption keys is part of Cloud KMS From the official documentation: “To protect your agents' data by using encryption keys that you control,<br>you can use [CMEKs](/kms/docs/cmek)<br>that you create and manage in Cloud KMS.”
- BigQuery works with Cloud KMS From the official documentation: “# Enable the BigQuery service account to encrypt/decrypt Cloud KMS keys”
- Cloud KMS works with Key Access Justifications From the official documentation: “Key Access Justifications enable control over viewing and approving key access<br>requests in Cloud KMS or [certain external key<br>management partners](/kms/docs/ekm#compatibility).”
- Cloud KMS works with Pub/Sub From the official documentation: “This page shows you how to use [Pub/Sub](/pubsub) to create notifications on state changes for Cloud KMS resources.”
- Cloud KMS works with Workflows From the official documentation: “You might encounter errors when using Cloud KMS with Workflows.”
- Application Default Credentials secures Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Asset Inventory works with Cloud KMS From the official documentation: “You can use Cloud Asset Inventory to programmatically list and filter your Cloud KMS assets by algorithm type.”
- Cloud Audit Logs works with Cloud KMS From the official documentation: “To access the justification, you first need to enable Cloud Audit Logs with Cloud KMS on the project containing the key used for encryption.”
- Cloud Build works with Cloud KMS From the official documentation: “Integrate Cloud Build with Cloud KMS and Artifact Analysis to create and sign cryptographic attestations when unit tests and static analysis tests complete successfully.”
- Cloud EKM works with Cloud KMS From the official documentation: “To learn how to use external keys with Cloud Key Management Service, see [Cloud External Key Manager](/kms/docs/ekm).”
- Cloud HSM works with Cloud KMS From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud KMS secures BigQuery From the official documentation: “If reading from BigQuery using query source, use this Cloud KMS key to encrypt any temporary tables created.”
- Cloud KMS works with Cloud Monitoring From the official documentation: “Learn about [using Cloud Monitoring with Cloud KMS](/kms/docs/monitoring#rate_quota_metrics).”
- Cloud KMS works with Knowledge Catalog From the official documentation: “Knowledge Catalog supports Cloud KMS keys, Cloud HSM keys, and Cloud External Key Manager keys.”
- Key Access Justifications configures Cloud KMS From the official documentation: “[Key Access Justifications](https://cloud.google.com/assured-workloads/key-access-justifications/docs/overview) | View logged justifications for each access request to Cloud KMS keys and optionally set a policy to authorize key access requests based on the provided…”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Knowledge Catalog depends on Application Default Credentials From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials works with Google Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- BigQuery works with Knowledge Catalog From the official documentation: “Some Knowledge Catalog functionalities trigger job execution using BigQuery.”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- BigQuery works with Cloud Monitoring From the official documentation: “You can use Monitoring to export your metrics to BigQuery.”
- Cloud Run works with Pub/Sub From the official documentation: “Route Cloud Pub/Sub events to Cloud Run”
- BigQuery works with Cloud Asset Inventory From the official documentation: “You can also use Cloud Asset Inventory to transfer this data into BigQuery.”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- BigQuery is an alternative to Google Cloud Storage From the official documentation: “The training data can be either a CSV file in Cloud Storage or a table in BigQuery.”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- BigQuery works with Google Cloud Storage From the official documentation: “Load Cloud Storage data into BigQuery”
- Cloud Monitoring depends on Application Default Credentials From the official documentation: “To authenticate to Monitoring, set up Application Default Credentials.”
- Cloud Run depends on Pub/Sub From the official documentation: “Create a Pub/Sub topic that Cloud Scheduler will publish to and the Cloud Run function will subscribe to.”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- Application Default Credentials works with Workflows From the official documentation: “To authenticate to Workflows, set up Application Default Credentials.”
- BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
- Cloud Build works with Cloud Run From the official documentation: “Cloud Build - create container images and deploy to Cloud Run.”
- Cloud Build works with Cloud Storage From the official documentation: “Cloud Build then stores Terraform files and the Terraform State File in a Cloud Storage bucket.”
- Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Cloud Run works with Workflows From the official documentation: “Route Workflows events to Cloud Run”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- customer-managed encryption keys secures Pub/Sub From the official documentation: “Encrypt Pub/Sub topic with CMEK”
- Application Default Credentials secures Knowledge Catalog From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- BigQuery works with Cloud Audit Logs From the official documentation: “Cloud Audit Logs maintain a record of Google Cloud events, including BigQuery events.”
- Cloud Storage works with customer-managed encryption keys From the official documentation: “Cloud Storage supports CMEK for routing logs.”
- Cloud Storage works with Pub/Sub From the official documentation: “| **Google Cloud** | Cloud Storage | Pub/Sub |”
- Cloud Storage is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
How learners score on this topic
Last updated