nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #159

You are backing up application logs to a shared Cloud Storage bucket that is accessible to both the administrator and analysts. Analysts should not have access to logs that contain any personally…

The correct answer is D. Use Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file. To automatically identify and separate log files containing PII before they become accessible to analysts in a shared bucket, use a Pub/Sub and Cloud Functions workflow that triggers a Cloud Data Loss Prevention (DLP) scan on new log uploads.

Submitted by joshua94· Apr 18, 2026Ensuring data protection

Question

You are backing up application logs to a shared Cloud Storage bucket that is accessible to both the administrator and analysts. Analysts should not have access to logs that contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible to the administrator. What should you do?

Options

  • AUpload the logs to both the shared bucket and the bucket with PII that is only accessible to the
  • BOn the shared bucket, configure Object Lifecycle Management to delete objects that contain PII.
  • COn the shared bucket, configure a Cloud Storage trigger that is only triggered when PII is
  • DUse Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file

How the community answered

(44 responses)
  • A
    2% (1)
  • B
    5% (2)
  • C
    9% (4)
  • D
    84% (37)

Why each option

To automatically identify and separate log files containing PII before they become accessible to analysts in a shared bucket, use a Pub/Sub and Cloud Functions workflow that triggers a Cloud Data Loss Prevention (DLP) scan on new log uploads.

AUpload the logs to both the shared bucket and the bucket with PII that is only accessible to the

Uploading logs directly to both buckets would bypass the PII detection requirement for the shared bucket and does not automate the identification of PII.

BOn the shared bucket, configure Object Lifecycle Management to delete objects that contain PII.

Object Lifecycle Management is for deleting objects based on age or versioning, not for identifying and acting upon the content (PII) of an object.

COn the shared bucket, configure a Cloud Storage trigger that is only triggered when PII is

Cloud Storage triggers are based on events (e.g., object creation, deletion) but do not inherently include PII detection capabilities; a separate service like Cloud DLP is needed for content scanning.

DUse Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a fileCorrect

This solution leverages Cloud DLP to automatically scan new log files for PII upon upload, typically orchestrated by Pub/Sub notifications to Cloud Functions. If PII is detected, the Cloud Function can then move or copy the sensitive log file to the administrator-only bucket, ensuring that PII never resides in the shared bucket accessible to analysts. This proactive approach prevents unauthorized access to sensitive data and automates compliance with data access policies.

Concept tested: Automated PII detection and data segregation

Source: https://cloud.google.com/dlp/docs/inspecting-cloud-storage

Topics

#Cloud DLP#Cloud Storage#Serverless Automation#PII Handling

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice