4Data management

• 4.1Access control and governance

  Understand enforcing least privilege with IAM, the difference among basic roles, predefined roles, and permissions for data services (BigQuery, Cloud Storage), Cloud Storage access control (public/private, uniform access), and when to share data securely with Analytics Hub.

• 4.2Lifecycle management

  Understand choosing Cloud Storage classes by access frequency and retention requirements, configuring rules to auto-delete objects after a period to reduce storage cost (Cloud Storage, BigQuery), and evaluating archiving services by business requirements.

• 4.3High availability, disaster recovery, and security

  Understand Google-managed backup/recovery for Cloud Storage and Cloud SQL, when to use replication, primary/secondary location types for redundancy, the choice among CMEK/CSEK/GMEK encryption keys, the role of Cloud KMS, and encryption in transit vs at rest.