Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ337

Ensuring data protection

You discover that sensitive personally identifiable information (PII) is ingested into your Google Cloud environment during the daily ETL process from an on-premises environment to your BigQuery datasets. You need to redact this information to obfuscate the PII, while still needing to re-identify it for data analytics purposes. Which components should you use in your solution?

Choose two
  • A Secret Manager
  • B Cloud Key Management Service
  • C Cloud Data Loss Prevention with cryptographic hashing
  • D Cloud Data Loss Prevention with automatic text redaction
  • E Cloud Data Loss Prevention with deterministic encryption using AES-SIV
Explanation

Cloud Data Loss Prevention deterministic encryption using AES-SIV provides reversible de-identification, allowing the same PII values to be obfuscated and later re-identified with the original cryptographic key. Cloud Key Management Service supplies the key-management and key-wrapping capability used by this workflow. Cryptographic hashing and automatic text redaction cannot be reversed.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!