Google Professional Machine Learning Engineer Question 133
Select 3Google Cloud PlatformYou are building a machine learning model on Google Cloud to predict patient readmission rates for a healthcare provider. The dataset includes sensitive information such as patient names, Social Security numbers, and medical diagnosis codes. What steps should you take to ensure compliance with privacy regulations and securely handle this data?
- A
Use Data Loss Prevention (DLP) to de-identify sensitive information before storing or processing the dataset.
- B
Encrypt the dataset using Cloud Key Management Service (KMS) before uploading it to Cloud Storage.
- C
Store the dataset in a public Cloud Storage bucket to facilitate easy access for the development team.
- D
Use IAM roles to restrict access to the dataset to only authorized team members.
- E
Train the model on the raw dataset to minimize preprocessing complexity.
Show answer and explanation
Correct answers: A, B, D
Explanation
Handling sensitive data such as PII and PHI requires comprehensive security measures to comply with privacy regulations and mitigate risks. By using de-identification tools like Data Loss Prevention (DLP), encrypting data with KMS, and restricting access with IAM roles, you can securely handle sensitive datasets while maintaining compliance. Storing the data in a public bucket or using raw data without preprocessing violates security principles and should be avoided.
- A. Correct.
Using Data Loss Prevention (DLP) is a best practice for identifying and de-identifying sensitive information (e.g., PII/PHI) to ensure compliance with privacy regulations like HIPAA.
- B. Correct.
Encrypting the dataset with Cloud Key Management Service (KMS) adds an additional layer of security to protect sensitive data while in transit or at rest.
- C. Incorrect.
Storing sensitive data in a public Cloud Storage bucket violates security best practices and could lead to unauthorized access and data breaches.
- D. Correct.
Restricting access using IAM roles ensures that only authorized team members can access sensitive data, following the principle of least privilege.
- E. Incorrect.
Training the model on the raw dataset without de-identification or preprocessing exposes sensitive information, posing a compliance risk and violating data privacy regulations.