Choosing an encryption and key management approach for data at rest and in transit
Google Cloud encrypts all data at rest and in transit by default using AES-256, with no configuration required for baseline protection. For workloads needing more control, Cloud KMS provides customer-managed encryption keys (CMEK), and Cloud HSM/external key management extend this to hardware-backed or fully external key control.
1 · Learn the must-know
- By default, Google applies Google-managed encryption keys to all data at rest across services like BigQuery, Cloud Storage, and Compute Engine with no user setup needed.
- CMEK (Customer-Managed Encryption Keys) via Cloud KMS lets you control key rotation, disabling, and destruction, but Google still performs the actual encryption operations.
- CSEK (Customer-Supplied Encryption Keys) allows you to provide your own raw AES-256 key at request time (supported by Cloud Storage and Compute Engine persistent disks), but Google does not store the key, losing it means permanent data loss.
- Cloud External Key Manager (Cloud EKM) lets keys reside entirely outside Google Cloud in a supported external key management partner system, giving separation between key ownership and cloud data storage.
- Destroying a CMEK key in Cloud KMS renders all data encrypted with it permanently unreadable, so key destruction is a deliberate, scheduled, and irreversible operation (default 24-hour pending window).
- IAM permissions on Cloud KMS keys (e.g., roles/cloudkms.cryptoKeyEncrypterDecrypter) are separate from storage/service IAM, enabling separation of duties between who can access data and who can manage/use the encryption keys.
2 · Check your understanding
A retailer stores customer purchase history in a BigQuery dataset and must be able to instantly cut off all access to that data, including from Google support, by disabling a single encryption key if a security incident occurs. Which key management approach for the dataset meets this requirement?
What you have tried across GCP PDE's objectives, not a readiness score.
Designing data processing systems~22% of the exam0 of 17 tried
Ingesting and processing the data~25% of the exam0 of 11 tried
Storing the data~20% of the exam0 of 13 tried
Preparing and using data for analysis~15% of the exam0 of 11 tried
Maintaining and automating data workloads~18% of the exam0 of 15 tried
3 · Keep going
Ready for more? Take a weighted mock or try free practice questions.