Google Professional Cloud Security Engineer Question 295
Select 2Google Cloud PlatformYour company processes sensitive customer information, including personally identifiable information (PII), in Google Cloud Storage. To comply with regulations, you need to ensure that all uploaded files are automatically scanned for PII, and any detected PII is pseudonymized. Additionally, you want to use format-preserving encryption for specific fields such as credit card numbers. Which combination of Google Cloud tools and configurations should you use to achieve this?
- A
Use Cloud Data Loss Prevention (DLP) to create an inspection job that scans Cloud Storage for PII and applies pseudonymization and format-preserving encryption.
- B
Enable Object Change Notifications on the Cloud Storage bucket to trigger a Cloud Function, which invokes Cloud DLP for PII discovery and transformation.
- C
Configure a Cloud Storage Transfer Service job to scan files for PII and apply pseudonymization.
- D
Set up a Cloud DLP template to pseudonymize PII and configure a Cloud Storage bucket to automatically apply the template to all newly uploaded objects.
- E
Use BigQuery Data Masking to scan Cloud Storage and apply format-preserving encryption to sensitive fields.
Show answer and explanation
Correct answers: A, B
Explanation
To achieve sensitive data protection in Cloud Storage, Cloud DLP is the recommended tool for discovering and transforming PII. Creating an inspection job ensures consistent application of pseudonymization and format-preserving encryption. Additionally, Object Change Notifications can automate the process by triggering a Cloud Function to invoke DLP for new uploads. Cloud Storage Transfer Service and BigQuery Data Masking are not suitable for this use case.
- A. Correct.
Correct: Cloud Data Loss Prevention (DLP) is the primary tool for scanning data for PII and applying transformations like pseudonymization and format-preserving encryption. Creating an inspection job ensures automated scanning and transformation of sensitive data.
- B. Correct.
Correct: By enabling Object Change Notifications on Cloud Storage, you can trigger a Cloud Function to invoke Cloud DLP for PII discovery and transformation, ensuring an automated workflow for newly uploaded files.
- C. Incorrect.
Incorrect: Cloud Storage Transfer Service is designed for transferring data between storage locations. It cannot scan files for PII or apply pseudonymization.
- D. Incorrect.
Incorrect: While Cloud DLP templates can define inspection and transformation rules, there is no native capability in Cloud Storage to automatically apply these templates to newly uploaded files.
- E. Incorrect.
Incorrect: BigQuery Data Masking is specific to masking query results in BigQuery and cannot be used to scan or transform data stored in Cloud Storage.