What's changed: Created Associate Data Practitioner Chapter 4 (Domain 4 "Data management": access control and governance = IAM least privilege/predefined roles/Cloud Storage uniform access/Analytics Hub; lifecycle management = storage classes/lifecycle rules/BigQuery expiration; HA/DR and security = backup/recovery/replication/primary-secondary location/CMEK-CSEK-GMEK/Cloud KMS/encryption at rest-in transit).
4.3High availability, disaster recovery, and security
Understand Google-managed backup/recovery for Cloud Storage and Cloud SQL, when to use replication, primary/secondary location types for redundancy, the choice among CMEK/CSEK/GMEK encryption keys, the role of Cloud KMS, and encryption in transit vs at rest.
Data must be not lost and protected. Cover availability/disaster recovery (backup, redundancy) and security via encryption.
4.3.1Backup/recovery and redundancy
Cloud Storage and Cloud SQL provide Google-managed backup/recovery to restore data from accidental deletion or failures. For higher availability, keep data redundant with replication, combining primary and secondary locations (region/dual/multi-region/zone) to withstand regional failures. Map "recover from failures = backup" and "availability via redundancy = replication/multi-region."
4.3.2Encryption and key management
| Key | Meaning |
|---|---|
| GMEK | Google-managed (default) keys |
| CMEK | Customer-managed keys via Cloud KMS |
| CSEK | Customer-supplied keys |
Google Cloud encrypts data at rest and in transit by default. The default keys are Google-managed GMEK. As required, choose CMEK where the customer manages keys via Cloud KMS (controlling rotation and disabling) or CSEK where the customer supplies the key itself. Map "manage keys yourself = CMEK (Cloud KMS)," "supply the key yourself = CSEK," and "default if no special requirement = GMEK."
Common: requirement → means. E.g., "restore from deletion/failure" = backup/recovery; "availability via redundancy" = replication/multi-region; "manage keys yourself (rotate/disable)" = CMEK (Cloud KMS); "supply the key yourself" = CSEK; "no special requirement" = GMEK (default); "encrypted at rest and in transit" = default encryption.
Watch the mix-ups: (1) do not confuse GMEK (Google-managed)/CMEK (customer-managed via Cloud KMS)/CSEK (customer-supplied). (2) Encrypted by default (at rest and in transit without special config). (3) Availability comes from redundant locations.
4.3.3Section summary
- Backup/recovery (Google-managed) and replication/primary-secondary locations for availability/DR
- Keys = GMEK (default, Google-managed)/CMEK (customer-managed via Cloud KMS)/CSEK (customer-supplied)
- Encrypted at rest and in transit by default
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To manage encryption keys yourself and control rotation/disabling, what do you use in Google Cloud?
Q2. With no special key-management requirement, which Google-managed default encryption key is used?
Q3. To restore Cloud Storage or Cloud SQL data from accidental deletion or failures, what do you use?
Q4. Which correctly describes data encryption in Google Cloud?
Q5. To give data high availability that withstands regional failures, which is most appropriate?
Q6. Which encryption-key approach has the customer supply the key itself?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.