Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud feature
customer-supplied encryption keys
Topic in 3 exam domains
- customer-supplied encryption keys · Feature
- customer-supplied encryption keys · Concept
- Customer-Supplied Encryption Keys · Feature
- Customer-supplied encryption keys · Feature
Also called: CSEK, CSEKs, Customer Supplied Encryption keys, customer-supplied key
An encryption method where the user supplies their own raw encryption keys to Google Cloud to encrypt and decrypt disks.
Where this appears on the exam
3 objectives in 2 of 5 domains
Related topics
This topicWorks alongsideBuilds on theseBuilds on theseBuilds on theseApplied
customer-supplied encryption keysFeature
Cloud Key Management ServiceServiceSpannerServiceCloud StorageServiceCloud External Key ManagerServicecustomer-managed encryption keysFeatureCompute EngineServiceSecret ManagerServiceCloud LoggingServiceManaged Service for Apache SparkServicePersistent DiskServiceCloud SQLServiceBigQueryServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- customer-managed encryption keys is an alternative to customer-supplied encryption keys From the official documentation: “CSEK and CMEK are mutually exclusive for the target disk.”
- Compute Engine works with customer-supplied encryption keys From the official documentation: “With customer-supplied encryption keys, you store the key material and provide it to Cloud Storage or Compute Engine when needed.”
- customer-supplied encryption keys secures Compute Engine From the official documentation: “Enable CSEK On Compute Engine Persistent Disks”
- Cloud External Key Manager is an alternative to customer-supplied encryption keys From the official documentation: “Customer-supplied encryption keys (CSEK) are not recommended; scenarios that historically were addressed by CSEK are now better addressed by Cloud External Key Manager (Cloud EKM) because Cloud EKM has support for more services and higher availability.”
- Cloud Key Management Service is an alternative to customer-supplied encryption keys From the official documentation: “You can protect a machine image by using either [Cloud Key Management Service (Cloud KMS)](/kms/docs) or a customer-supplied encryption key (CSEK) ([Deprecated](/compute/docs/deprecations)).”
- Cloud Storage works with customer-supplied encryption keys From the official documentation: “With customer-supplied encryption keys, you store the key material and provide it to Cloud Storage or Compute Engine when needed.”
- customer-supplied encryption keys is part of Cloud Storage From the official documentation: “Customer-supplied encryption keys (CSEK) are a feature in [Cloud Storage](/storage).”
- customer-supplied encryption keys secures Cloud Storage From the official documentation: “CSEK is best for scenarios where you have an existing key management system outside of Google Cloud and you want to use those keys to encrypt your Cloud Storage data.”
- customer-supplied encryption keys is part of Compute Engine From the official documentation: “CSEK will be completely removed from Compute Engine on **July 20, 2027**.”
- customer-supplied encryption keys is part of Persistent Disk From the official documentation: “Cloud Build leverages the Customer-Supplied Encryption Key (CSEK) feature of persistent disk to use this new encryption key as a persistent disk encryption key.”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- Cloud SQL works with Cloud Storage From the official documentation: “When ingesting data from Cloud SQL, data is first staged to a Cloud Storage bucket.”
- Cloud SQL works with Compute Engine From the official documentation: “Create a Compute Engine VM Instance to host a sample web app that connects to Cloud SQL.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- Persistent Disk is part of Compute Engine From the official documentation: “Compute Engine offers different types of persistent disks.”
- BigQuery works with Spanner From the official documentation: “Reverse ETL (BigQuery to Spanner)”
- Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- BigQuery works with Managed Service for Apache Spark From the official documentation: “This means you can quickly read and write BigQuery data to and from Managed Service for Apache Spark.”
- Cloud Logging works with Cloud SQL From the official documentation: “Cloud SQL uses Cloud Logging.”
- Cloud SQL depends on Compute Engine From the official documentation: “Cloud SQL uses Compute Engine virtual machines (VMs) with persistent storage disks.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- customer-managed encryption keys secures Cloud SQL From the official documentation: “Enable CMEK for Cloud SQL Databases”
- Cloud SQL works with Secret Manager From the official documentation: “Secret Manager attempts to update the credentials in your Cloud SQL instance.”
- Cloud Storage works with customer-managed encryption keys From the official documentation: “Cloud Storage supports CMEK for routing logs.”
- customer-managed encryption keys secures Secret Manager From the official documentation: “In Secret Manager, you can use a CMEK to protect data at rest.”
- BigQuery is an alternative to Managed Service for Apache Spark From the official documentation: “Run queries against your federated data using BigQuery or Managed Service for Apache Spark.”
- Cloud Logging works with Cloud Storage From the official documentation: “Cloud Storage writes various log entries to Cloud Logging in the Google Cloud console.”
- Cloud Storage works with Managed Service for Apache Spark From the official documentation: “Managed Service for Apache Spark accesses these files on Cloud Storage.”
- BigQuery works with Cloud Key Management Service From the official documentation: “Change the Cloud KMS key for a BigQuery table”
- BigQuery depends on Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- Cloud Key Management Service works with Cloud SQL From the official documentation: “Cloud KMS integrates with Cloud SQL.”
- Cloud Logging works with Compute Engine From the official documentation: “Compute Engine sends you Cloud Logging events for scheduled, started, or completed maintenance.”
- Cloud Storage works with Compute Engine From the official documentation: “You can use a web browser, the Google Cloud CLI, or a programming language to transfer files between Cloud Storage and Compute Engine VMs.”
- Compute Engine works with Persistent Disk From the official documentation: “Add a persistent disk to Compute Engine”
- customer-managed encryption keys is part of Cloud Key Management Service From the official documentation: “The Cloud KMS keys that you create are customer-managed keys.”
- customer-managed encryption keys works with Spanner From the official documentation: “This page describes how to use manually-created customer-managed encryption keys (CMEK) for Spanner.”
- Managed Service for Apache Spark depends on Cloud Storage From the official documentation: “Managed Service for Apache Spark uses Cloud Storage as its default distributed file system.”
- Cloud Key Management Service secures BigQuery From the official documentation: “You can encrypt data at the dataset or project level with the default customer-managed Cloud Key Management Service keys in BigQuery.”
- Cloud Key Management Service is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Compute Engine works with Managed Service for Apache Spark From the official documentation: “Yes, Managed Service for Apache Spark has native and automatic integrations with Compute Engine, Cloud Storage, Bigtable, BigQuery, Logging, and Cloud Monitoring.”
- customer-managed encryption keys secures Cloud Logging From the official documentation: “Cloud Logging supports encrypting Log storage with CMEK keys.”
- customer-managed encryption keys is part of Cloud Storage From the official documentation: “[Cloud Storage](/storage/docs/introduction) provides features such as customer-managed encryption, lifecycle management, and aging and retention policies.”
- customer-managed encryption keys secures Compute Engine From the official documentation: “In IL5, CMEK is enabled by default for Compute Engine, Google Kubernetes Engine (GKE), Cloud Storage, and Cloud SQL.”
- customer-managed encryption keys secures Managed Service for Apache Spark From the official documentation: “For data encryption at rest, use the [Cloud Key Management Service](/kms/docs/key-management-service) (KMS) or [Customer Managed Encryption Keys](/managed-spark/docs/concepts/configuring-clusters/customer-managed-encryption) (CMEK).”
- BigQuery depends on Cloud Storage From the official documentation: “BigQuery relies on Cloud Storage for staging file data and supports reading from and writing to several other sources and Google Cloud services.”
- BigQuery works with Compute Engine From the official documentation: “Compute Engine integrates with Google Cloud technologies such as Cloud Storage, Google Kubernetes Engine, and BigQuery, to extend beyond the basic computational capability to create more complex and sophisticated applications.”
- Cloud External Key Manager is part of Cloud Key Management Service From the official documentation: “In addition to these features, the Assured Workloads control package you choose will also determine which of the following Cloud KMS key types are available: - [Cloud EKM keys](/kms/docs/ekm#overview)”
- Cloud External Key Manager works with Cloud Key Management Service From the official documentation: “You can use an externally managed key with CMEK using the Cloud External Key Manager service to [make the key available](/kms/docs/ekm) through Cloud KMS.”
- Cloud External Key Manager is an alternative to Cloud Key Management Service From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud External Key Manager secures Cloud SQL From the official documentation: “To protect data in Cloud SQL instances, you can use keys that you manage within a supported external key management partner. For more information, see [Cloud External Key Manager](/kms/docs/ekm), including the [Considerations](/kms/docs/ekm#considerations) section.”
- Cloud External Key Manager is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud External Key Manager secures Managed Service for Apache Spark From the official documentation: “[Cloud External Key Manager (Cloud EKM)](/kms/docs/ekm) lets you protect Managed Service for Apache Spark data using keys managed by a [supported external key management partner](/kms/docs/ekm#supported_partners).”
- Cloud External Key Manager works with Secret Manager From the official documentation: “In Secret Manager, you can use Cloud External Key Manager (Cloud EKM) keys to encrypt and decrypt secrets.”
- Cloud External Key Manager works with Spanner From the official documentation: “In addition, Spanner supports Cloud External Key Manager (Cloud EKM), which lets you store your keys in an external key manager outside of Google Cloud.”
How learners score on this topic
Last updated