Google Professional Data Engineer Question 195
Select 3Google Cloud PlatformYou are designing a system on Google Cloud to process and store sensitive customer data, such as social security numbers and credit card information. To comply with your organization's security policies, you need to ensure that only authorized users can view sensitive data and that it is masked or redacted when accessed by non-authorized users. Which of the following steps should you take to achieve this?
- A
Use Cloud Data Loss Prevention (Cloud DLP) to scan and classify sensitive data, and configure it to automatically redact sensitive information before it is stored.
- B
Grant the 'roles/dlp.deidentifyTemplatesEditor' IAM role to all users who need to view the sensitive data.
- C
Create and apply a Cloud DLP de-identification template to redact sensitive data for non-authorized users during data access.
- D
Use IAM to restrict access to sensitive data by granting the 'roles/storage.objectViewer' role only to authorized users for the storage bucket.
- E
Implement Cloud DLP inspection jobs to continuously monitor sensitive data and notify administrators of potential policy violations.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure sensitive customer data, you can use Cloud DLP to classify and redact sensitive information, apply IAM roles to restrict access, and use de-identification templates to ensure non-authorized users cannot view sensitive details. This approach ensures compliance with security policies while providing fine-grained control over data access and visibility.
- A. Correct.
Correct. Cloud Data Loss Prevention (Cloud DLP) can scan and classify sensitive data and apply redaction or masking before data is stored, ensuring sensitive information is protected.
- B. Incorrect.
Incorrect. The 'roles/dlp.deidentifyTemplatesEditor' role allows users to create and edit de-identification templates, but this does not restrict or control access to sensitive data.
- C. Correct.
Correct. Creating and applying a Cloud DLP de-identification template ensures sensitive data is redacted or masked for non-authorized users during access, meeting security requirements.
- D. Correct.
Correct. IAM roles like 'roles/storage.objectViewer' can be used to restrict access to sensitive data in Cloud Storage, ensuring only authorized users can view it.
- E. Incorrect.
Incorrect. While Cloud DLP inspection jobs can monitor sensitive data, this does not directly address the need to control access or redact information for non-authorized users.