Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Task
key rotation
Topic in 2 exam domains
- key rotation · Task
- key rotation · Concept
- Key rotation · Task · Apigee CMEK
- key rotation · Feature · Cloud KMS
Also called: Keyset rotation, KMS Key Rotation, rotate, rotate a key, rotate the private/public key pair, Rotate user key, rotate your key, Rotate your keys, rotating encryption keys, Rotating keys
The process of reducing data exposure by adding a new primary cryptographic key to a keyset and re-encrypting data.
Where this appears on the exam
2 subdomains in 2 of 5 domains
Related topics
FoundationsBuilding blocksBuilding blocksBuilding blocksBuilding blocksBuilding blocksBuilding blocksThis topicWorks alongsideAppliedKey Access JustificationsFeatureCloud Key Management ServiceServicecustomer-managed encryption keysFeatureBigQueryServiceservice accountConceptApplication Default CredentialsFeatureCloud KMSService
key rotationTask
Workload Identity FederationFeatureservice account keyConceptPoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- key rotation is part of Cloud Key Management Service From the official documentation: “This page discusses key rotation in Cloud Key Management Service.”
- key rotation configures service account key From the official documentation: “We recommend that you routinely rotate all keys that you manage, including your service account keys.”
- Cloud KMS configures key rotation From the official documentation: “If you need a new key version for your instances, you'll need to rotate your key using Cloud Key Management Service.”
- key rotation is part of Cloud KMS From the official documentation: “When you rotate a key in Cloud KMS, Cloud KMS creates a new version of that key.”
- key rotation secures service account key From the official documentation: “Rotating service account keys can help reduce the risk posed by leaked or stolen keys.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- customer-managed encryption keys depends on Cloud KMS From the official documentation: “You must have a symmetric encryption key in Cloud KMS to use for CMEK.”
- service account key is an alternative to Workload Identity Federation From the official documentation: “Workload Identity Federation lets you access Google Cloud resources from outside of Google Cloud without using a service account key.”
- Cloud KMS works with customer-managed encryption keys From the official documentation: “With customer-managed encryption keys (CMEK), volume keys are wrapped using your keys stored in Cloud KMS.”
- customer-managed encryption keys is part of Cloud Key Management Service From the official documentation: “The Cloud KMS keys that you create are customer-managed keys.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- service account works with Workload Identity Federation From the official documentation: “When an application uses Workload Identity Federation, it impersonates a service account.”
- service account key is part of service account From the official documentation: “Create a service account key:”
- Application Default Credentials configures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with Cloud Key Management Service From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- BigQuery works with Cloud Key Management Service From the official documentation: “A Cloud KMS key is considered available and accessible by BigQuery under the following conditions:”
- Cloud KMS depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with service account From the official documentation: “You can authenticate the service account using Application Default Credentials (ADC) or a service account key.”
- BigQuery works with Cloud KMS From the official documentation: “BigQuery stores the name of the key used to encrypt the table content and uses that key when a table protected by Cloud KMS is queried.”
- Cloud Key Management Service works with service account From the official documentation: “When your Database Migration Service migration jobs have CMEK enabled, you need to use a service account to request key access from Cloud Key Management Service.”
- Cloud KMS secures BigQuery From the official documentation: “If reading from BigQuery using query source, use this Cloud KMS key to encrypt any temporary tables created.”
- Cloud KMS works with Key Access Justifications From the official documentation: “Key Access Justifications enable control over viewing and approving key access<br>requests in Cloud KMS or [certain external key<br>management partners](/kms/docs/ekm#compatibility).”
- customer-managed encryption keys is part of Cloud KMS From the official documentation: “If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including Dataflow.”
- Key Access Justifications configures Cloud Key Management Service From the official documentation: “[Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview) lets you set a policy on Cloud KMS keys to view, approve, and deny key access requests depending on the provided justification code.”
- service account works with service account key From the official documentation: “You can authenticate the service account using Application Default Credentials (ADC) or a service account key.”
- Application Default Credentials secures Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials depends on service account From the official documentation: “If your `BidiProcessOrder` client runs in a secure environment that can be configured with service account credentials (such as Compute Engine, Google Kubernetes Engine, or your on-premise servers), it can use [Application Default Credentials…”
- Application Default Credentials is an alternative to service account From the official documentation: “There are two ways to obtain credentials for the agent to use: - Let the agent use a service account with private-key authentication - Let the agent use application default credentials (ADC).”
- Application Default Credentials works with Workload Identity Federation From the official documentation: “The preferred method to set up authentication from outside of Google Cloud is to use workload identity federation. For more information, see [Set up ADC for on-premises or another cloud provider](/docs/authentication/set-up-adc-on-premises) in the authentication documentation.”
- BigQuery works with service account From the official documentation: “The service account can be used by services, such as Cloud Run, to read and modify data in the BigQuery dataset.”
- Cloud Key Management Service depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Key Management Service is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud Key Management Service works with Key Access Justifications From the official documentation: “[Key Access Justifications](https://cloud.google.com/blog/products/identity-security/control-access-to-gcp-data-with-key-access-justifications) integrate with Cloud KMS and Cloud EKM.”
- Cloud KMS works with Workload Identity Federation From the official documentation: “1. An application that is integrated with Workload Identity Federation uses Cloud KMS to decrypt a wrapped encryption key.”
- customer-managed encryption keys is part of BigQuery From the official documentation: “If you require more control over encryption keys, BigQuery supports [customer-managed encryption keys](/bigquery/docs/customer-managed-encryption) in the [Cloud Key Management Service](/kms/docs).”
- Key Access Justifications configures Cloud KMS From the official documentation: “[Key Access Justifications](https://cloud.google.com/assured-workloads/key-access-justifications/docs/overview) | View logged justifications for each access request to Cloud KMS keys and optionally set a policy to authorize key access requests based on the provided…”
- service account depends on BigQuery From the official documentation: “Each feature view uses a service account to access the source data in BigQuery during sync.”
- service account depends on Cloud Key Management Service From the official documentation: “When your Database Migration Service migration jobs have CMEK enabled, you need to use a service account to request key access from Cloud Key Management Service.”
How learners score on this topic
Last updated