You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implemen

The correct answer is D. Import a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option. For those that saying BigQuery does not support CSEK, read the below. You will need to import you CSEK and it will become CMEK. From there you can use it for BigQuery. https://cloud.google.com/bigquery/docs/customer-managed-encryption

Submitted by tunde_lagos· Mar 30, 2026Designing for security and compliance

Question

You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implement a solution. What should you do?

Options

AGenerate a new key in Cloud Key Management Service (Cloud KMS). Store all data in Cloud
BGenerate a new key in Cloud KMS. Create a dataset in BigQuery using the customer-managed
CImport a key in Cloud KMS. Store all data in Cloud Storage using the customer-managed key
DImport a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option

How the community answered

(21 responses)

A
14% (3)
B
5% (1)
C
5% (1)
D
76% (16)

Explanation

For those that saying BigQuery does not support CSEK, read the below. You will need to import you CSEK and it will become CMEK. From there you can use it for BigQuery. https://cloud.google.com/bigquery/docs/customer-managed-encryption

Topics

#customer-supplied encryption keys#BigQuery encryption#Cloud KMS#key management

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-ARCHITECT Practice