Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Concept
key
Topic in 2 exam domains
- key · Concept
- _key · Concept · Bigtable SQL column
- __key__ · Concept · Cloud Datastore pseudoproperty
- Key · Concept
- KEY · Concept · custom audit information
Also called: crypto key, CryptoKey, Datastore key
A cryptographic key stored within a key ring in Cloud KMS.
Where this appears on the exam
2 subdomains in 2 of 5 domains
Related topics
FoundationsBuilding blocksBuilding blocksBuilding blocksBuilding blocksThis topicAppliedSingle-tenant Cloud HSMFeatureApplication Default CredentialsFeatureIdentity and Access ManagementServiceCloud Key Management ServiceServiceCloud KMSServicekey ringConceptCloud HSMServicecustomer-managed encryption keysFeatureDataflowServiceBigQueryServiceCloud SQLService
keyConcept
Key versionConceptnamespaceConceptPoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- key is part of Cloud Key Management Service From the official documentation: “Creates a new key in Cloud KMS with labels.”
- key is part of Cloud KMS From the official documentation: “CryptoKey: Cloud KMS key.”
- key is part of Dataflow From the official documentation: “The smallest unit of parallel processing in Dataflow is a key.”
- key is part of key ring From the official documentation: “Select the key ring that contains the key.”
- key is an alternative to key ring From the official documentation: “The resource name can be either a key or a key ring.”
- Key version is part of key From the official documentation: “A key contains zero or more key versions.”
- namespace is part of key From the official documentation: “The key consists of the following components: - The *namespace* of the entity, which allows for [*multitenancy*](/datastore/docs/concepts/multitenancy)”
- Single-tenant Cloud HSM configures key From the official documentation: “If you want to create the key in a Single-tenant Cloud HSM instance, set `PROTECTION_LEVEL` to `hsm-single-tenant` and add the `--cryptoKeyBackend` flag to specify the resource identifier of the Single-tenant Cloud HSM instance where you want to create the key:”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- BigQuery works with Dataflow From the official documentation: “Read from BigQuery to Dataflow”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- customer-managed encryption keys secures Cloud SQL From the official documentation: “Enable CMEK for Cloud SQL Databases”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- customer-managed encryption keys depends on Cloud KMS From the official documentation: “You must have a symmetric encryption key in Cloud KMS to use for CMEK.”
- Application Default Credentials secures Dataflow From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- Cloud KMS works with customer-managed encryption keys From the official documentation: “With customer-managed encryption keys (CMEK), volume keys are wrapped using your keys stored in Cloud KMS.”
- customer-managed encryption keys is part of Cloud Key Management Service From the official documentation: “The Cloud KMS keys that you create are customer-managed keys.”
- Application Default Credentials configures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with Dataflow From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- Dataflow depends on Application Default Credentials From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- Application Default Credentials works with Cloud Key Management Service From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- BigQuery works with Cloud Key Management Service From the official documentation: “A Cloud KMS key is considered available and accessible by BigQuery under the following conditions:”
- Cloud KMS depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with Cloud SQL From the official documentation: “Application Default Credentials are part of the client libraries you can use to access Cloud SQL.”
- Application Default Credentials works with Identity and Access Management From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- BigQuery works with Cloud KMS From the official documentation: “BigQuery stores the name of the key used to encrypt the table content and uses that key when a table protected by Cloud KMS is queried.”
- BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
- Cloud HSM is part of Cloud Key Management Service From the official documentation: “You can import into Multi-tenant Cloud HSM keys, Single-tenant Cloud HSM keys, or software keys in Cloud KMS.”
- Cloud Key Management Service works with Cloud SQL From the official documentation: “Cloud KMS integrates with Cloud SQL.”
- Cloud SQL depends on Cloud KMS From the official documentation: “Cloud SQL administrator operations, such as create, clone, or update, might fail due to Cloud KMS errors, and missing roles or permissions.”
- customer-managed encryption keys is part of Cloud KMS From the official documentation: “If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including Dataflow.”
- key ring is part of Cloud Key Management Service From the official documentation: “`LOCATION`: the Cloud KMS location of the key ring.”
- Application Default Credentials secures Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud HSM depends on Cloud Key Management Service From the official documentation: “Because Cloud HSM uses Cloud KMS as its front end, you can leverage all the conveniences and features that Cloud KMS provides.”
- Cloud HSM works with Cloud Key Management Service From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud HSM works with Cloud KMS From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud HSM is an alternative to Single-tenant Cloud HSM From the official documentation: “Single-tenant Cloud HSM provides the same functionality as Multi-tenant Cloud HSM, with the added benefit of cryptographic isolation from other Google Cloud customers.”
- Cloud Key Management Service depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Key Management Service is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud Key Management Service depends on Identity and Access Management From the official documentation: “Whatever the mechanism, Cloud KMS resolves the provided credential to identify the principal (the entity which is authenticated and is authorizing the request), and calls IAM to see whether the principal is authorized to make the request and whether an audit log is written.”
- Cloud Key Management Service works with Identity and Access Management From the official documentation: “The Cloud KMS platform is integrated with [IAM](/iam/docs/overview) and [Cloud Audit Logs](/logging/docs/audit) so that you can manage permissions on individual keys and audit how they are used.”
- Cloud KMS secures BigQuery From the official documentation: “If reading from BigQuery using query source, use this Cloud KMS key to encrypt any temporary tables created.”
- Cloud KMS works with Dataflow From the official documentation: “If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including Dataflow.”
- Cloud SQL works with Dataflow From the official documentation: “Use Datastream to replicate changes from your MySQL instance to either BigQuery or Cloud Storage, and then use Dataflow or Managed Service for Apache Spark to bring the data into your Cloud SQL instance.”
- Cloud SQL works with Identity and Access Management From the official documentation: “This page describes how Cloud SQL is integrated with IAM .”
- customer-managed encryption keys is part of BigQuery From the official documentation: “If you require more control over encryption keys, BigQuery supports [customer-managed encryption keys](/bigquery/docs/customer-managed-encryption) in the [Cloud Key Management Service](/kms/docs).”
- customer-managed encryption keys is part of Cloud SQL From the official documentation: “Cloud SQL also lets you add another layer of encryption to data using [customer-managed encryption keys (CMEK)](/sql/docs/postgres/cmek).”
- customer-managed encryption keys works with Dataflow From the official documentation: “This sample shows how to use encryption keys managed by the customer, with a Dataflow pipeline.”
- customer-managed encryption keys secures Dataflow From the official documentation: “You can either create CMEKs manually to protect your Dataflow resources or use Cloud KMS Autokey.”
- Dataflow depends on Identity and Access Management From the official documentation: “Dataflow uses Identity and Access Management (IAM) for authorization.”
- Identity and Access Management depends on Application Default Credentials From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Identity and Access Management secures BigQuery From the official documentation: “Security in BigQuery is intrinsically linked to [Identity and Access Management (IAM)](/iam/docs/overview) in Google Cloud.”
- Identity and Access Management secures Cloud Key Management Service From the official documentation: “If you need to prevent a user from using a Cloud KMS resource during the time needed for propagation of an eventually consistent operation, remove the Identity and Access Management (IAM) permission for the resource.”
- Identity and Access Management secures Cloud KMS From the official documentation: “To manage access to Cloud KMS resources, such as keys and key rings, you grant [Identity and Access Management (IAM) roles](/iam/docs/overview).”
- Identity and Access Management configures Dataflow From the official documentation: “To control access to Dataflow resources for users, groups, and service accounts in a project or organization, use Identity and Access Management (IAM).”
How learners score on this topic
Last updated