Google Professional Cloud Security Engineer Question 297
Select 3Google Cloud PlatformYour organization processes sensitive customer data, including Personally Identifiable Information (PII), as part of its cloud operations. You are tasked with implementing a solution on Google Cloud to identify and redact PII from text files uploaded to a Cloud Storage bucket. Additionally, the organization requires pseudonymization of sensitive data while maintaining a readable format for certain fields (e.g., phone numbers). Which of the following steps should you take to fulfill these requirements?
- A
Use Google Cloud Data Loss Prevention (DLP) to scan the data for PII and configure the built-in redaction capabilities to mask sensitive information.
- B
Use Google Cloud Data Loss Prevention (DLP) to tokenize sensitive fields using format-preserving encryption.
- C
Enable Cloud Storage Object Versioning to ensure that the original files remain accessible for auditing purposes.
- D
Configure a Cloud Function to automatically trigger when new files are uploaded and invoke the DLP API for PII detection and transformation.
- E
Set up Identity and Access Management (IAM) policies to restrict access to the Cloud Storage bucket containing sensitive data.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements of identifying, redacting, and pseudonymizing PII, you need to leverage Google Cloud's Data Loss Prevention (DLP) API. DLP can detect sensitive data and apply transformations such as redaction and tokenization with format-preserving encryption. Automating this process via a Cloud Function ensures that files are processed immediately upon upload. While enabling Object Versioning and setting IAM policies are good practices for data management and security, they do not specifically address the stated requirements.
- A. Correct.
This is correct. Google Cloud's DLP API can detect and redact PII from data in Cloud Storage or other services, addressing the requirement to remove sensitive information.
- B. Correct.
This is correct. Tokenization with format-preserving encryption allows you to pseudonymize sensitive data while maintaining a readable format, which aligns with the organization's requirements.
- C. Incorrect.
This is incorrect. While enabling Object Versioning in Cloud Storage helps with recovery and auditing, it does not directly address the need to redact or pseudonymize sensitive data.
- D. Correct.
This is correct. Configuring a Cloud Function to trigger upon file uploads and invoke the DLP API automates the process of identifying and transforming PII.
- E. Incorrect.
This is incorrect. Although IAM policies are essential for securing access to sensitive data, they do not fulfill the specific requirements of redacting and pseudonymizing PII.