Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud feature
CMEK
Topic in 4 exam domains
- CMEK · Feature
- CMEK · Concept
Also called: CMEK encryption keys, Customer Managed Encryption Key, customer-managed key, customer-managed storage encryption, customer-managed-encryption-key
Customer-managed encryption keys used to encrypt databases and messaging topics.
Where this appears on the exam
4 objectives in 3 of 5 domains
Related topics
FoundationsThis topicWorks alongsideBuilds on theseAppliedCloud Key Management ServiceServiceApigeeServiceApplication Default CredentialsFeatureVPC Service ControlsServicecustomer-managed encryption keysFeature
CMEKFeature
DataflowServiceCloud MonitoringServiceCloud LoggingServicePub/SubServiceGKEServiceCloud StorageServiceBigQueryServiceCompute EngineServiceAlloyDBServiceDataprocServiceArtifact RegistryServiceCloud RunServiceCloud SQLServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- CMEK secures Pub/Sub From the official documentation: “Encrypt Pub/Sub topic with CMEK”
- CMEK secures Cloud SQL From the official documentation: “Enable CMEK for Cloud SQL Databases”
- CMEK secures BigQuery From the official documentation: “Enable CMEK for BigQuery Tables”
- CMEK secures Cloud Storage From the official documentation: “Enable CMEK for Cloud Storage Buckets”
- CMEK secures AlloyDB From the official documentation: “Enable CMEK for AlloyDB Clusters”
- CMEK secures Dataproc From the official documentation: “Require CMEK on Dataproc Clusters”
- CMEK secures Artifact Registry From the official documentation: “You use the CMEK keys to help protect your data in Artifact Registry and in Cloud Run.”
- CMEK depends on Cloud Key Management Service From the official documentation: “Modify the CMEK configuration on a parameter by updating the parameter to use the new Cloud KMS key resource names.”
- CMEK secures Compute Engine From the official documentation: “Enable CMEK on Compute Engine Persistent Disks”
- CMEK works with Dataflow From the official documentation: “The region for your CMEK and the [region](/dataflow/docs/resources/locations) for your Dataflow job must be the same.”
- CMEK secures GKE From the official documentation: “Enable CMEK on GKE Node Pool Boot Disks”
- CMEK is part of Apigee From the official documentation: “**Dashboard availability:** This dashboard is not available if your Apigee organization was provisioned with compliance-related Apigee features, such as [data residency](/apigee/docs/api-platform/get-started/drz-concepts)…”
- CMEK secures Cloud Run From the official documentation: “You use the CMEK keys to help protect your data in Artifact Registry and in Cloud Run.”
- CMEK works with Pub/Sub From the official documentation: “By using Pub/Sub with CMEK, you are able to meet locality rules about encryption while still maintaining high availability.”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- AlloyDB depends on Application Default Credentials From the official documentation: “To authenticate to AlloyDB, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Dataflow depends on Application Default Credentials From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- AlloyDB works with Application Default Credentials From the official documentation: “To authenticate to AlloyDB, set up Application Default Credentials.”
- BigQuery works with Dataflow From the official documentation: “Read from BigQuery to Dataflow”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Run works with Cloud SQL From the official documentation: “Learn how to connect to Cloud SQL from Cloud Run”
- Application Default Credentials works with Dataflow From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- VPC Service Controls secures BigQuery From the official documentation: “BigQuery data is protected with VPC Service Controls”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- Cloud SQL works with Cloud Storage From the official documentation: “When ingesting data from Cloud SQL, data is first staged to a Cloud Storage bucket.”
- BigQuery works with Cloud Monitoring From the official documentation: “You can use Monitoring to export your metrics to BigQuery.”
- Cloud Run works with Pub/Sub From the official documentation: “Route Cloud Pub/Sub events to Cloud Run”
- Cloud SQL works with Compute Engine From the official documentation: “Create a Compute Engine VM Instance to host a sample web app that connects to Cloud SQL.”
- Dataflow works with Pub/Sub From the official documentation: “Pub/Sub notifies Dataflow about the upload.”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- Cloud Logging works with GKE From the official documentation: “Enable Cloud Logging on GKE Clusters”
- Compute Engine is an alternative to GKE From the official documentation: “To use TPU7x, you can use Google Kubernetes Engine (GKE) or Compute Engine.”
- Cloud Monitoring depends on Application Default Credentials From the official documentation: “To authenticate to Monitoring, set up Application Default Credentials.”
- Cloud Monitoring works with Cloud SQL From the official documentation: “You can also get more details by viewing the Cloud Monitoring logs for your Cloud SQL destination instance.”
- Cloud Monitoring works with GKE From the official documentation: “Enable Cloud Monitoring on GKE Clusters”
- Cloud Run depends on Pub/Sub From the official documentation: “Create a Pub/Sub topic that Cloud Scheduler will publish to and the Cloud Run function will subscribe to.”
- Cloud Storage works with Dataflow From the official documentation: “Write from Dataflow to Cloud Storage”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
- Cloud Logging works with Cloud SQL From the official documentation: “Cloud SQL uses Cloud Logging.”
- Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Cloud Run is an alternative to GKE From the official documentation: “The app uses Cloud SQL, Vertex AI, and either Google Kubernetes Engine (GKE) or Cloud Run.”
- Cloud SQL depends on Compute Engine From the official documentation: “Cloud SQL uses Compute Engine virtual machines (VMs) with persistent storage disks.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
How learners score on this topic
Last updated