Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Concept
Key version
Topic in 1 exam domain
Also called: crypto key version, CryptoKeyVersion, key versions
A specific iteration of a cryptographic key in Cloud KMS, which progresses through states such as PENDING_IMPORT, ENABLED, or DESTROYED.
Where this appears on the exam
1 objective in 1 of 5 domains
~25% of exam
Related topics
FoundationsBuilding blocksBuilding blocksBuilding blocksThis topicApplication Default CredentialsFeatureIdentity and Access ManagementServiceCloud Key Management ServiceServiceCloud KMSServiceWorkflowsServiceCloud Audit LogsServiceSpannerServicekey ringConceptCloud SQLServiceBigQueryService
Key versionConcept
Points to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Identity and Access Management configures Key version From the official documentation: “You can also manage access to a key version using Identity and Access Management (IAM).”
- Key version is part of Cloud Key Management Service From the official documentation: “// checkStateImportedKey checks the state of a CryptoKeyVersion in KMS.”
- Key version is part of Cloud KMS From the official documentation: “// checkStateImportedKey checks the state of a CryptoKeyVersion in KMS.”
- Key version is part of key ring From the official documentation: “A key ring is the root resource for Cloud KMS keys and key versions.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Application Default Credentials secures Spanner From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- Application Default Credentials works with Spanner From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- Spanner depends on Application Default Credentials From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- Application Default Credentials works with Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud KMS depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- BigQuery works with Spanner From the official documentation: “Reverse ETL (BigQuery to Spanner)”
- Cloud SQL works with Identity and Access Management From the official documentation: “This page describes how Cloud SQL is integrated with IAM .”
- Application Default Credentials works with Workflows From the official documentation: “To authenticate to Workflows, set up Application Default Credentials.”
- BigQuery works with Cloud Audit Logs From the official documentation: “Cloud Audit Logs maintain a record of Google Cloud events, including BigQuery events.”
- Application Default Credentials works with Cloud Key Management Service From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with Identity and Access Management From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Identity and Access Management secures BigQuery From the official documentation: “Access to BigQuery data from AlloyDB is managed through IAM.”
- BigQuery works with Cloud Key Management Service From the official documentation: “Change the Cloud KMS key for a BigQuery table”
- BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
- Cloud Audit Logs works with Cloud Key Management Service From the official documentation: “Cloud Audit Logs for Cloud KMS in the Activity stream read like generic logs, and are not easily read by a human.”
- Cloud Key Management Service works with Cloud SQL From the official documentation: “Cloud KMS integrates with Cloud SQL.”
- Identity and Access Management secures Spanner From the official documentation: “Spanner uses Identity and Access Management (IAM) for authorization.”
- BigQuery works with Cloud KMS From the official documentation: “# Enable the BigQuery service account to encrypt/decrypt Cloud KMS keys”
- BigQuery works with Workflows From the official documentation: “To learn more about using Workflows with BigQuery, see [Run multiple BigQuery jobs in parallel](/workflows/docs/tutorials/bigquery-parallel-jobs).”
- Cloud Key Management Service depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Key Management Service secures BigQuery From the official documentation: “You can encrypt data at the dataset or project level with the default customer-managed Cloud Key Management Service keys in BigQuery.”
- Cloud KMS works with Workflows From the official documentation: “You might encounter errors when using Cloud KMS with Workflows.”
- Identity and Access Management depends on Application Default Credentials From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Identity and Access Management secures Workflows From the official documentation: “This page describes the Identity and Access Management (IAM) roles and permissions available to control access to Workflows resources.”
- key ring is part of Cloud Key Management Service From the official documentation: “`LOCATION`: the Cloud KMS location of the key ring.”
- Workflows depends on Application Default Credentials From the official documentation: “To authenticate to Workflows, set up Application Default Credentials.”
- Application Default Credentials configures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials secures Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Application Default Credentials works with Cloud SQL From the official documentation: “Application Default Credentials are part of the client libraries you can use to access Cloud SQL.”
- Application Default Credentials secures Workflows From the official documentation: “To authenticate to Workflows, set up Application Default Credentials.”
- Cloud Audit Logs works with Cloud KMS From the official documentation: “To access the justification, you first need to enable Cloud Audit Logs with Cloud KMS on the project containing the key used for encryption.”
- Cloud Key Management Service depends on Identity and Access Management From the official documentation: “Whatever the mechanism, Cloud KMS resolves the provided credential to identify the principal (the entity which is authenticated and is authorizing the request), and calls IAM to see whether the principal is authorized to make the request and whether an audit log is written.”
- Cloud Key Management Service works with Identity and Access Management From the official documentation: “The Cloud KMS platform is integrated with [IAM](/iam/docs/overview) and [Cloud Audit Logs](/logging/docs/audit) so that you can manage permissions on individual keys and audit how they are used.”
- Cloud Key Management Service depends on Spanner From the official documentation: “Cloud KMS stores all of its data and metadata in Spanner databases which provide high data durability and availability with synchronous replication.”
- Cloud Key Management Service works with Spanner From the official documentation: “After the database is created, Spanner calls Cloud KMS about every five minutes to make sure that the key is still valid.”
- Cloud Key Management Service secures Spanner From the official documentation: “For Spanner databases in [custom, dual-region, or multi-region instance configurations](/spanner/docs/instance-configurations#configuration), you can use multiple regional (single-region) Cloud KMS keys to protect your database.”
- Cloud Key Management Service works with Workflows From the official documentation: “Latencies of encrypt requests to KMS by workflows for CMEK.”
- Cloud KMS secures BigQuery From the official documentation: “If reading from BigQuery using query source, use this Cloud KMS key to encrypt any temporary tables created.”
- Cloud KMS secures Cloud SQL From the official documentation: “The reason is because Cloud SQL uses [regional Cloud KMS keys](https://cloud.google.com/sql/docs/mysql/configure-cmek#key) for encryption when CMEK is enabled on the instance.”
- Cloud KMS works with Spanner From the official documentation: “These entries are logged as the zones in your Spanner instance poll the Cloud KMS key about every five minutes.”
- Cloud SQL is an alternative to Spanner From the official documentation: “If you're interested in evaluating how the performance of your on-premises databases compares to [Cloud SQL](/sql), [Spanner](/spanner), [Firestore](/firestore), or [Bigtable](/bigtable), you could implement a PoC where the same business logic uses different databases.”
- Identity and Access Management secures Cloud Audit Logs From the official documentation: “IAM permissions and roles determine your ability to access audit logs data in the [Logging API](/logging/docs/reference/v2/rest), the [Logs Explorer](/logging/docs/view/logs-explorer-interface), and the [Google Cloud CLI](/logging/docs/reference/tools/gcloud-logging).”
- Identity and Access Management secures Cloud Key Management Service From the official documentation: “If you need to prevent a user from using a Cloud KMS resource during the time needed for propagation of an eventually consistent operation, remove the Identity and Access Management (IAM) permission for the resource.”
- Identity and Access Management secures Cloud KMS From the official documentation: “To manage access to Cloud KMS resources, such as keys and key rings, you grant [Identity and Access Management (IAM) roles](/iam/docs/overview).”
- Identity and Access Management works with Workflows From the official documentation: “Workflows manages access and authentication using Identity and Access Management (IAM) roles and permissions.”
- key ring is part of Cloud KMS From the official documentation: “Creates a new key ring in Cloud KMS”
- Spanner depends on Identity and Access Management From the official documentation: “Spanner relies on IAM for identity management rather than managing user credentials within the database.”
- Workflows depends on Identity and Access Management From the official documentation: “Workflows uses [IAM](/iam/docs/overview) for access control.”
How learners score on this topic
Last updated