Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Concept
customer-managed encryption keys
Topic in 7 exam domains
- customer-managed encryption keys · Concept
- customer managed encryption keys · Feature
- Customer-Managed Encryption Keys · Feature
- customer-managed encryption keys · Feature
- Customer-managed encryption keys · Feature
- Customer-managed Encryption Keys · Feature
- customer-managed-encryption keys · Feature
- Customer Managed Encryption Keys · Feature
- Customer-managed encryption keys · Concept
- customer managed encryption keys · Concept
- Customer-Managed Encryption keys · Feature
- Customer managed encryption keys · Feature · Apigee
Also called: CMEK keys, CMEKs, Customer Managed Multi-Region Encryption Key, customer-managed Cloud KMS keys, Customer-managed encryption, customer-managed encryption key (CMEK), customer-managed keys, CustomerManaged Encryption Key, CustomerManaged Encryption Keys, default KMS key, encryption keys managed by the customer, MR CMEK, multi-region encryption keys
Encryption keys managed by the customer (via Cloud KMS) to encrypt vSAN data at rest.
Where this appears on the exam
6 objectives in 2 of 5 domains
Related topics
FoundationsBuilding blocksThis topicWorks alongsideAppliedCloud Key Management ServiceServiceApplication Default CredentialsFeatureVPC Service ControlsServiceCloud KMSServiceCloud MonitoringService
customer-managed encryption keysFeature
customer-supplied encryption keysFeatureIdentity and Access ManagementServiceCloud LoggingServiceCloud StorageServiceCloud SQLServiceDatabase Migration ServiceServiceBigQueryServicePub/SubServiceSecret ManagerServiceApigeeServiceArtifact RegistryServiceCloud RunServiceCompute EngineServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- customer-managed encryption keys depends on Cloud KMS From the official documentation: “You must have a symmetric encryption key in Cloud KMS to use for CMEK.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- customer-managed encryption keys secures Cloud SQL From the official documentation: “Enable CMEK for Cloud SQL Databases”
- customer-managed encryption keys secures Pub/Sub From the official documentation: “Encrypt Pub/Sub topic with CMEK”
- Cloud Storage works with customer-managed encryption keys From the official documentation: “Cloud Storage supports CMEK for routing logs.”
- customer-managed encryption keys is an alternative to customer-supplied encryption keys From the official documentation: “CSEK and CMEK are mutually exclusive for the target disk.”
- customer-managed encryption keys secures Secret Manager From the official documentation: “In Secret Manager, you can use a CMEK to protect data at rest.”
- Cloud KMS works with customer-managed encryption keys From the official documentation: “With customer-managed encryption keys (CMEK), volume keys are wrapped using your keys stored in Cloud KMS.”
- customer-managed encryption keys secures Artifact Registry From the official documentation: “Artifact Registry also supports [organization policy constraints](/artifact-registry/docs/cmek#org-policy) that can require CMEK to protect resources.”
- customer-managed encryption keys works with Database Migration Service From the official documentation: “Database Migration Service supports CMEK in the migration job to secure the data at rest.”
- Apigee works with customer-managed encryption keys From the official documentation: “This page describes using CMEK with Apigee.”
- customer-managed encryption keys is part of Cloud Key Management Service From the official documentation: “The Cloud KMS keys that you create are customer-managed keys.”
- customer-managed encryption keys is part of Cloud KMS From the official documentation: “To protect your agents' data by using encryption keys that you control,<br>you can use [CMEKs](/kms/docs/cmek)<br>that you create and manage in Cloud KMS.”
- customer-managed encryption keys secures Database Migration Service From the official documentation: “When you protect data in Database Migration Service with CMEK, the CMEK is within your control.”
- Cloud Key Management Service is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- customer-managed encryption keys secures Cloud Logging From the official documentation: “Cloud Logging supports encrypting Log storage with CMEK keys.”
- customer-managed encryption keys is part of Cloud Storage From the official documentation: “[Cloud Storage](/storage/docs/introduction) provides features such as customer-managed encryption, lifecycle management, and aging and retention policies.”
- customer-managed encryption keys secures Compute Engine From the official documentation: “In IL5, CMEK is enabled by default for Compute Engine, Google Kubernetes Engine (GKE), Cloud Storage, and Cloud SQL.”
- Cloud SQL works with customer-managed encryption keys From the official documentation: “To learn more about using customer-managed encryption keys with Cloud SQL, see [Overview of customer-managed encryption keys](/sql/docs/postgres/cmek).”
- customer-managed encryption keys secures Apigee From the official documentation: “To ensure that customer-managed encryption keys are always used when encrypting your data in Apigee, create the following organization policy constraint:”
- customer-managed encryption keys secures Cloud Run From the official documentation: “If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including Cloud Run.”
- customer-managed encryption keys is part of Cloud SQL From the official documentation: “Cloud SQL also lets you add another layer of encryption to data using [customer-managed encryption keys (CMEK)](/sql/docs/postgres/cmek).”
- customer-managed encryption keys works with Secret Manager From the official documentation: “If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including Secret Manager.”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- Cloud SQL works with Database Migration Service From the official documentation: “Migrating from Cloud SQL to AlloyDB for PostgreSQL using Database Migration Service”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Application Default Credentials works with Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Run works with Cloud SQL From the official documentation: “Learn how to connect to Cloud SQL from Cloud Run”
- Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- VPC Service Controls secures BigQuery From the official documentation: “BigQuery data is protected with VPC Service Controls”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud SQL works with Cloud Storage From the official documentation: “When ingesting data from Cloud SQL, data is first staged to a Cloud Storage bucket.”
- BigQuery works with Cloud Monitoring From the official documentation: “You can use Monitoring to export your metrics to BigQuery.”
- Cloud Run works with Pub/Sub From the official documentation: “Route Cloud Pub/Sub events to Cloud Run”
- Cloud SQL works with Compute Engine From the official documentation: “Create a Compute Engine VM Instance to host a sample web app that connects to Cloud SQL.”
- Application Default Credentials works with Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Cloud Run works with Secret Manager From the official documentation: “You can integrate Secret Manager with other Google Cloud products such as Cloud Run.”
- Pub/Sub works with Secret Manager From the official documentation: “Receive notifications via Pub/Sub when Secret Manager resources change.”
- Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- Cloud KMS depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Storage works with Database Migration Service From the official documentation: “Database Migration Service replicates data from SQL Server backup and transaction log files that you upload to a Cloud Storage bucket.”
- Secret Manager depends on Application Default Credentials From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Cloud Monitoring depends on Application Default Credentials From the official documentation: “To authenticate to Monitoring, set up Application Default Credentials.”
- Cloud Monitoring works with Cloud SQL From the official documentation: “You can also get more details by viewing the Cloud Monitoring logs for your Cloud SQL destination instance.”
How learners score on this topic
Last updated