Google Professional Cloud Developer Question 446
Select 3Google Cloud PlatformYou are building a RESTful API on Google Cloud to serve customer data. Due to compliance requirements, you must ensure that sensitive fields such as 'Social Security Number' and 'Credit Card Information' are excluded from the API response. Which solution(s) should you implement to restrict the return data effectively?
- A
Use field-level encryption to mask sensitive fields in the database.
- B
Implement a custom serialization logic to exclude sensitive fields from API responses.
- C
Utilize Firestore's security rules to prevent the sensitive fields from being queried in the first place.
- D
Use a Cloud Function middleware to filter out sensitive fields before sending the response.
- E
Rely on the frontend to hide sensitive fields from being displayed to the user.
Show answer and explanation
Correct answers: B, C, D
Explanation
Restricting return data is a critical aspect of building secure applications. Custom serialization, Firestore security rules, and middleware layers like Cloud Functions are effective ways to ensure sensitive fields are not included in API responses. Field-level encryption is more suited for data protection at rest, while frontend-based filtering is insecure because it does not prevent data exposure in API responses.
- A. Incorrect.
Field-level encryption is used to protect data at rest but does not inherently restrict sensitive fields from being included in API responses. Additional filtering would still be required.
- B. Correct.
Custom serialization logic is a valid approach to explicitly exclude sensitive fields when generating API responses.
- C. Correct.
Firestore's security rules can be configured to restrict access to sensitive fields, preventing them from being queried in the first place.
- D. Correct.
A Cloud Function middleware can act as a layer to filter out sensitive fields dynamically before sending the response to the client.
- E. Incorrect.
Depending on the frontend to hide sensitive fields is not secure, as the data would still be present in the API response and could be accessed by malicious users.