nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #179

You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on- premises environment to your BigQuery…

The correct answer is B. Cloud Key Management Service E. Cloud Data Loss Prevention with deterministic encryption using AES-SIV. B: you need KMS to store the CryptoKey https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#crypt E: for the de-identity you need to use CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig…

Submitted by wei.xz· Apr 18, 2026Ensuring data protection

Question

You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on- premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes. Which components should you use in your solution? (Choose two.)

Options

  • ASecret Manager
  • BCloud Key Management Service
  • CCloud Data Loss Prevention with cryptographic hashing
  • DCloud Data Loss Prevention with automatic text redaction
  • ECloud Data Loss Prevention with deterministic encryption using AES-SIV

How the community answered

(59 responses)
  • A
    8% (5)
  • B
    69% (41)
  • C
    17% (10)
  • D
    5% (3)

Explanation

B: you need KMS to store the CryptoKey https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#crypt E: for the de-identity you need to use CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#cryptodetermini https://cloud.google.com/dlp/docs/deidentify-sensitive-data

Topics

#DLP#KMS#Data Redaction#Deterministic Encryption

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice