Google Professional Cloud Security Engineer Question 296
Select 3Google Cloud PlatformYour company processes customer data that includes personally identifiable information (PII) such as names, social security numbers, and email addresses. You are tasked with ensuring compliance with data privacy regulations by protecting this sensitive information during storage and processing in Google Cloud. Which of the following steps should you take to configure Sensitive Data Protection (SDP) appropriately?
- A
Use Cloud DLP (Data Loss Prevention) to discover and classify sensitive data in storage and redact PII as needed.
- B
Use format-preserving encryption to encrypt sensitive data while preserving its structure for downstream processing.
- C
Enable Cloud Identity-Aware Proxy (IAP) to restrict access to applications containing sensitive PII data.
- D
Configure pseudonymization of sensitive data using Cloud DLP to replace PII with surrogate values.
- E
Use VPC Service Controls to define a perimeter around sensitive data resources.
Show answer and explanation
Correct answers: A, B, D
Explanation
Configuring Sensitive Data Protection (SDP) in Google Cloud involves using Cloud DLP for discovering, classifying, and redacting sensitive data, as well as implementing techniques like pseudonymization and format-preserving encryption to secure PII. While tools like IAP and VPC Service Controls improve overall security, they do not directly handle sensitive data protection mechanisms for compliance purposes.
- A. Correct.
Correct. Cloud DLP is specifically designed for discovering, classifying, and redacting sensitive data, including PII, making it essential for Sensitive Data Protection.
- B. Correct.
Correct. Format-preserving encryption ensures the data remains encrypted while retaining its format, which is crucial for applications that need to process the data without exposing sensitive information.
- C. Incorrect.
Incorrect. While Identity-Aware Proxy (IAP) is useful for securing access to applications, it does not directly configure Sensitive Data Protection measures such as redaction or encryption.
- D. Correct.
Correct. Pseudonymization using Cloud DLP replaces sensitive data with surrogate values, reducing the risk of exposing PII while maintaining data utility for analysis.
- E. Incorrect.
Incorrect. VPC Service Controls enhance network security by creating a service perimeter, but they do not directly address the discovery, redaction, or encryption of sensitive data.