What's changed: Created Professional Cloud Architect Chapter 5 (Domain 3 "Security and compliance": IAM/least privilege/governance = avoid basic roles/predefined-custom/groups, service accounts/Workload Identity Federation, organization policies/guardrails; data protection and compliance = GMEK/CMEK/CSEK/Cloud KMS/Cloud EKM, Sensitive Data Protection/Cloud DLP, data residency, Assured Workloads/Cloud Audit Logs/VPC Service Controls).
5.2Data protection and compliance
Understand encryption at rest/in transit and key management (GMEK/CMEK/CSEK/Cloud KMS), discovering and protecting sensitive data (Sensitive Data Protection / Cloud DLP), data residency and sovereignty, and regulatory compliance via Assured Workloads and audit logs.
After access control comes protecting the data itself and meeting regulations. Design encryption, key management, sensitive-data protection, and data residency to match requirements.
5.2.1Encryption and key management
| Key | Meaning |
|---|---|
| GMEK | Google-managed (default) keys |
| CMEK | Customer-managed keys via Cloud KMS |
| CSEK | Customer-supplied keys |
Google Cloud encrypts data at rest and in transit by default (default GMEK). To manage keys yourself with rotation/revocation control, choose CMEK (Cloud KMS); to supply the key itself, CSEK; to use an external key-management system, Cloud EKM. Choose by requirements (regulation, key sovereignty). Map "manage keys yourself = CMEK (Cloud KMS)," "external key mgmt = Cloud EKM," "no special need = GMEK."
5.2.2Sensitive data and compliance
Discover/classify/mask or tokenize sensitive data (e.g., PII) with Sensitive Data Protection (Cloud DLP). For compliance, combine data residency (keep data in a region), Assured Workloads (a controlled environment meeting regulatory requirements), Cloud Audit Logs (operational tracking), and VPC Service Controls (confidentiality). Map "discover/mask PII = Sensitive Data Protection," "compliant controlled environment = Assured Workloads," and "keep data in-country = data residency."
Common: requirement → means. E.g., "manage keys yourself (rotate/revoke)" = CMEK (Cloud KMS); "external key-management backend" = Cloud EKM; "detect and mask PII" = Sensitive Data Protection; "store data in a specific country" = data residency; "compliant controlled environment" = Assured Workloads; "track who did what" = Cloud Audit Logs.
Watch the mix-ups: (1) Do not confuse who manages GMEK/CMEK/CSEK/EKM. (2) Data is encrypted by default—the question is who manages the keys, not whether encryption exists. (3) Meet compliance via a combination of residency, controlled environment, audit, and perimeters.
Store secrets like API keys and passwords in Secret Manager with versioning, least-privilege IAM, automatic rotation, and audit logging; never hard-code them in source or environment variables.
5.2.3Section summary
- Encrypted at rest/in transit by default; choose keys GMEK (default)/CMEK (Cloud KMS)/CSEK/EKM
- Sensitive data: discover/mask with Sensitive Data Protection (Cloud DLP)
- Compliance = data residency + Assured Workloads + Cloud Audit Logs + VPC Service Controls
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To manage encryption keys yourself and control rotation/revocation, which is best?
Q2. To detect PII in data and mask/tokenize it, what do you use?
Q3. For compliance, to ensure data is stored in a specific country/region, which concept?
Q4. To hold keys in an external key-management backend while encrypting in Google Cloud, which is best?
Q5. To run workloads in a controlled environment meeting strict regulatory requirements, which is best?
Q6. Which correctly describes data encryption in Google Cloud?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.