Cloud KMS keys controlled by the customer that a Google Cloud service uses to encrypt its data instead of Google-managed keys. The product’s service agent needs the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.
On the ACE it comes up when writes fail with a permission error after configuring CMEK: the role was not granted to the service agent. The key must be in a location compatible with the resource.
CMEK (customer-managed encryption keys) is a concept that can show up on the exam. Check the full guide to see it in context.