A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally…

Question

Options

• AUse Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file
• BUpload the logs to both the shared bucket and the bucket only accessible by the administrator.
• COn the bucket shared with both the analysts and the administrator, configure Object Lifecycle
• DOn the bucket shared with both the analysts and the administrator, configure a Cloud Storage

• A
  85% (55)
• B
  5% (3)
• C
  9% (6)
• D
  2% (1)

Explanation

To automatically detect and segregate PII-containing log files, you need an event-driven pipeline: Cloud Storage sends object-creation notifications via Cloud Pub/Sub, which triggers a Cloud Function to invoke the Cloud Data Loss Prevention (DLP) API to scan the file's content. If PII is detected, the function moves the file to the restricted bucket; otherwise it remains in the shared bucket. This is the correct Google-recommended automated approach. Option B uploads all files to both buckets regardless of PII content. Option C uses Object Lifecycle Management, which operates on metadata conditions (age, storage class) not file content. Option D (Cloud Storage trigger alone) does not include a DLP scan.

No community discussion yet for this question.