Google Professional Data Engineer Question 3
Select 3Google Cloud PlatformYou are designing a data pipeline for a financial institution that handles sensitive customer information. The pipeline involves ingesting data into Google Cloud Storage, processing it with Dataflow, and storing the results in BigQuery. Which actions should you take to ensure the solution meets security and compliance requirements?
- A
Enable Customer-Managed Encryption Keys (CMEK) for all storage and processing services.
- B
Use a public bucket in Google Cloud Storage to share data with external partners.
- C
Implement Identity and Access Management (IAM) policies to restrict access to data and resources.
- D
Ensure all data in transit is encrypted using TLS.
- E
Disable audit logging for the pipeline to optimize performance.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design a secure and compliant data pipeline, you need to protect sensitive data at rest (e.g., using CMEK) and in transit (e.g., using TLS). Implementing IAM policies ensures only authorized access to resources, while audit logging enables tracking and compliance verification. Using a public bucket or disabling audit logging would compromise security and compliance.
- A. Correct.
Enabling CMEK allows you to control the encryption keys used to protect your data, which is critical for meeting compliance requirements in industries like finance.
- B. Incorrect.
Using a public bucket would expose sensitive customer data and violate security and compliance requirements.
- C. Correct.
IAM policies are essential for ensuring that only authorized users and systems have access to sensitive data and resources.
- D. Correct.
Encrypting data in transit using TLS ensures that the data remains secure while moving between services, which is a key compliance requirement.
- E. Incorrect.
Disabling audit logging would prevent you from tracking access and changes to your resources, which is often a regulatory requirement in financial and other sensitive industries.