Chapter 3 of 5 · Google Cloud Professional Cloud Security Engineer

Ensuring data protection

Sensitive Data Protection, secrets, Cloud KMS keys and AI security.

  • 5topics
  • 28 minfast track
  • 2diagrams and exhibits
  • 23%of the exam
Start with Sensitive Data Protection, De-identification and Pseudonymization

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Sensitive Data Protection, De-identification and PseudonymizationUse Sensitive Data Protection to discover and inspect PII on Google Cloud, then redact, mask, tokenize or apply format preserving…5 min
  2. 2Restricting Data Services, Secret Manager and Instance MetadataRestrict access to BigQuery, Cloud Storage and Cloud SQL, store and rotate secrets in Secret Manager, and protect Compute Engine…6 min
  3. 3Cloud KMS, CMEK, Cloud HSM and Cloud EKMChoose Google default encryption, CMEK, Cloud HSM or Cloud EKM, and create, rotate, disable, destroy and import Cloud KMS keys…Diagram6 min
  4. 4Encryption Use Cases, Object Lifecycle and Confidential ComputingMatch encryption at rest, in transit and in use to each use case, set Cloud Storage lifecycle and retention rules, and enable…5 min
  5. 5Securing AI Workloads and Gemini Enterprise Agent PlatformProtect AI training data and models, set security needs for IaaS and PaaS training, and secure Gemini Enterprise Agent Platform…6 min

About this chapter

What this chapter covers

Ensuring data protection is about 23% of the Google Cloud Professional Cloud Security Engineer exam. It covers how sensitive data is found, hidden, encrypted and kept safe wherever it is stored, moved or processed, including in AI systems.

It covers sensitive data and data loss (Sensitive Data Protection discovery and de-identification, access controls for BigQuery, Cloud Storage and Cloud SQL, Secret Manager and instance metadata), encryption (default encryption, CMEK, Cloud HSM, Cloud EKM, key rotation and import, object lifecycle rules and Confidential Computing) and AI workloads (protecting data and models, IaaS and PaaS training, and Gemini Enterprise Agent Platform).

The exam has 50 to 60 multiple choice and multiple select questions in 2 hours. Expect requirement phrases such as "must be able to revoke", "keys outside Google" or "analysts must not see real values", each of which maps to one specific control.

How the topics fit together

Finddiscovery, inspectionReducede identify, tokenizeRestrictIAM, policy tags, perimetersEncryptCMEK, HSM, EKM, in useAIdata, models, prompts

Finding data comes first, because you cannot protect what you have not located. Encryption choices then depend on who must control the keys, and AI workloads reuse every earlier control plus prompt and response screening.

Exam tip

Map key words to key options: "control and revoke" is CMEK, "hardware" is Cloud HSM, "outside Google" is Cloud EKM, and "in memory" is Confidential Computing.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with tables and code examples.
  • What to remember for the exam: the facts to memorise and how questions are phrased.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Ready for more practice?

The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.