Google Professional Cloud Security Engineer Question 294
Select 3Google Cloud PlatformYou are a security engineer at a company that processes sensitive customer data, including personally identifiable information (PII). You are tasked with configuring Sensitive Data Protection (SDP) in Google Cloud to ensure compliance with data privacy regulations. The requirements include detecting PII in Cloud Storage, redacting sensitive data in files uploaded to a bucket, and pseudonymizing user identifiers. Which combination of steps should you take to meet these requirements?
- A
Use Cloud DLP to create an inspection job for Cloud Storage to scan for PII data.
- B
Configure a Cloud Storage bucket to automatically encrypt all objects using Customer-Managed Encryption Keys (CMEK).
- C
Create a Cloud DLP de-identification template for redacting sensitive data and pseudonymizing user identifiers.
- D
Set up a Pub/Sub topic to receive notifications when new files are uploaded, and trigger a Cloud Function to apply the Cloud DLP de-identification template.
- E
Enable VPC Service Controls to restrict API access to Cloud Storage and Cloud DLP.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the requirements, you need to use Cloud DLP to detect and handle sensitive data like PII. An inspection job is necessary to scan for PII in Cloud Storage. A de-identification template is required to define the redaction and pseudonymization rules. Automating the process of applying the template to newly uploaded files can be achieved by integrating Cloud DLP with Pub/Sub and Cloud Functions. While encryption and access controls are good security practices, they do not satisfy the requirements for detecting, redacting, or pseudonymizing data.
- A. Correct.
Correct. Cloud DLP's inspection jobs are specifically designed to scan for sensitive data such as PII in data sources like Cloud Storage.
- B. Incorrect.
Incorrect. While encrypting objects in Cloud Storage using CMEK is a good practice for security, it does not address the requirement of detecting, redacting, or pseudonymizing PII.
- C. Correct.
Correct. Cloud DLP de-identification templates allow you to configure redaction and pseudonymization, which are required to handle sensitive data appropriately.
- D. Correct.
Correct. Setting up a Pub/Sub topic and triggering a Cloud Function ensures that the de-identification template is applied to new files uploaded to the bucket, automating the redaction and pseudonymization process.
- E. Incorrect.
Incorrect. While VPC Service Controls enhance the security of your data by restricting API access, they do not address the specific requirement of detecting, redacting, or pseudonymizing PII.