Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ69

Ensuring data protection

A financial services company must process customer personally identifiable information (PII) for analytics while complying with strict privacy regulations. The data must be transformed to protect individual privacy while retaining its original format and consistency for analytical integrity. The solution must avoid complete irreversible deletion. What should you do?

  • A Use Cloud Key Management Service (Cloud KMS) to encrypt the entire dataset with a customer-managed encryption key (CMEK).
  • B Set up VPC Service Controls around the BigQuery project. Implement row-level encryption.
  • C Implement a custom BigQuery user-defined function (UDF) by using JavaScript to hash all sensitive fields before they are loaded into the analytical tables.
  • D Configure Sensitive Data Protection (SDP) to de-identify PII using format-preserving encryption (FPE).
Explanation

Sensitive Data Protection format-preserving encryption (FPE) de-identifies PII by replacing it with encrypted tokens that preserve the input’s character set and length. FPE is reversible with the required cryptographic key, so it avoids irreversible deletion while maintaining format consistency and referential integrity for analytics.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!