Ensure data protection
Ensure data protection
This domain tests encryption choices, key management, sensitive-data discovery and de-identification, secret handling, and retention controls.
Core rules
- Encryption at rest is default with Google-managed keys. CMEK moves key control to Cloud KMS; Cloud EKM keeps keys external. CSEK is customer-supplied and supported for services such as Cloud Storage and Compute Engine disks-losing the key makes data unrecoverable. CMEK does not fix over-broad IAM.
- Cloud KMS organizes keys in key rings with locations. Separate duties: key admins manage IAM/rotation, encrypters/decrypters use keys. Rotation creates new versions; old versions remain for decryption. HSM protection level is available.
- Secret Manager stores API keys and passwords with versioning, IAM, audit logging, and rotation. Do not put secrets in code, metadata, or bucket objects.
- Sensitive Data Protection (DLP) discovers and classifies sensitive data, then de-identifies with masking, tokenization, or format-preserving encryption. It produces findings; it does not enforce access.
- Access controls: BigQuery column-level IAM and policy tags, Cloud Storage uniform bucket-level access, and IAM Conditions complement encryption. Encryption is not authorization.
- Retention: Cloud Storage retention policies and Object Lock, BigQuery table expiration, and bucket soft delete help meet retention and deletion requirements.
Worked example
A BigQuery dataset contains PII, and analysts need aggregate queries but not raw identifiers. Use DLP to inspect the table, create a de-identified copy with masking/tokenization, grant analysts roles/bigquery.dataViewer on the de-identified dataset only, and keep the raw dataset restricted with CMEK and audit logging. The reasoning separates discovery from enforcement: DLP classifies, IAM restricts, CMEK protects at rest.
Traps
Assuming CMEK prevents data access by authorized users; treating DLP as an access control; storing secrets in environment files in repositories; destroying KMS key versions without confirming data is unrecoverable; assuming DLP automatically rewrites existing data without a job in place; and forgetting that CSEK loss is permanent.