3Ensuring data protection
- 3.1Sensitive data protection and data loss prevention
Understand Sensitive Data Protection (SDP) for PII discovery/redaction, pseudonymization, and format-preserving encryption; restricting access to Google Cloud data services (BigQuery, Cloud Storage, Cloud SQL); securing secrets with Secret Manager; and protecting/managing compute instance metadata.
- 3.2Encryption and securing AI workloads
Understand use cases for Google default encryption, customer-managed encryption keys (CMEK), and Cloud External Key Manager (EKM); choosing software vs hardware keys; creating/managing CMEK/EKM keys (rotation/revocation/import); encryption methods per use case; Cloud Storage object lifecycle; Confidential Computing; and security/privacy controls for AI/ML systems and Vertex AI.

