thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Intermediate

Cloud Key Management Service (Cloud KMS)

Google Cloud service for managing symmetric and asymmetric encryption keys, including HSM-backed and external keys.

Definition

Cloud KMS organizes keys in key rings within locations, with key versions, rotation schedules and IAM-controlled use. Protection levels include software, Cloud HSM (FIPS 140-2 Level 3) and Cloud External Key Manager, where keys stay in a third-party system. Customer-managed encryption keys (CMEK) protect data in services like Cloud Storage and BigQuery; Autokey automates CMEK provisioning.

Example

A BigQuery dataset is encrypted with a CMEK from Cloud KMS that the security team can disable to revoke access.

Exam tip

Google encrypts all data at rest by default; CMEK adds customer control, and EKM lets keys stay outside Google.

Related terms