Choosing an encryption and key management approach for data at rest and in transit

Google Cloud encrypts all data at rest and in transit by default using AES-256, with no configuration required for baseline protection. For workloads needing more control, Cloud KMS provides customer-managed encryption keys (CMEK), and Cloud HSM/external key management extend this to hardware-backed or fully external key control.

Must-know

  • By default, Google applies Google-managed encryption keys to all data at rest across services like BigQuery, Cloud Storage, and Compute Engine with no user setup needed.
  • CMEK (Customer-Managed Encryption Keys) via Cloud KMS lets you control key rotation, disabling, and destruction, but Google still performs the actual encryption operations.
  • CSEK (Customer-Supplied Encryption Keys) allows you to provide your own raw AES-256 key at request time (supported by Cloud Storage and Compute Engine persistent disks), but Google does not store the key, losing it means permanent data loss.
  • Cloud External Key Manager (Cloud EKM) lets keys reside entirely outside Google Cloud in a supported external key management partner system, giving separation between key ownership and cloud data storage.
  • Destroying a CMEK key in Cloud KMS renders all data encrypted with it permanently unreadable, so key destruction is a deliberate, scheduled, and irreversible operation (default 24-hour pending window).
  • IAM permissions on Cloud KMS keys (e.g., roles/cloudkms.cryptoKeyEncrypterDecrypter) are separate from storage/service IAM, enabling separation of duties between who can access data and who can manage/use the encryption keys.
Drill this objectiveTake a weighted mockTry free practice questions

Coverage checked against the published exam guide on Aug 11, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.