What's changed: Created Associate Data Practitioner Chapter 4 (Domain 4 "Data management": access control and governance = IAM least privilege/predefined roles/Cloud Storage uniform access/Analytics Hub; lifecycle management = storage classes/lifecycle rules/BigQuery expiration; HA/DR and security = backup/recovery/replication/primary-secondary location/CMEK-CSEK-GMEK/Cloud KMS/encryption at rest-in transit).
4.3High availability, disaster recovery, and security
Understand Google-managed backup/recovery for Cloud Storage and Cloud SQL, when to use replication, primary/secondary location types for redundancy, the choice among CMEK/CSEK/GMEK encryption keys, the role of Cloud KMS, and encryption in transit vs at rest.
Data must be not lost and protected. Cover availability/disaster recovery (backup, redundancy) and security via encryption.
4.3.1Backup/recovery and redundancy
Cloud Storage and Cloud SQL provide Google-managed backup/recovery to restore data from accidental deletion or failures. For higher availability, keep data redundant with replication, combining primary and secondary locations (region/dual/multi-region/zone) to withstand regional failures. Map "recover from failures = backup" and "availability via redundancy = replication/multi-region."
4.3.2Encryption and key management
| Key | Meaning |
|---|---|
| GMEK | Google-managed (default) keys |
| CMEK | Customer-managed keys via Cloud KMS |
| CSEK | Customer-supplied keys |
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.