You are building a teal-lime prediction engine that streams files, which may contain Pll (personal identifiable information) data, into Cloud Storage and eventually into BigQuery. You want to ensure t

Question

Options

• ACreate a pseudonym by replacing the Pll data with cryptogenic tokens, and store the non-tokenized data in a locked-down button.
• BRedact all Pll data, and store a version of the unredacted data in a locked-down bucket
• CScan every table in BigQuery, and mask the data it finds that has Pll
• DCreate a pseudonym by replacing Pll data with a cryptographic format-preserving token

• A
  6% (2)
• B
  3% (1)
• C
  9% (3)
• D
  81% (26)

Explanation

D is correct because cryptographic format-preserving tokenization (using DLP's CryptoReplaceFfxFpeConfig) is deterministic - the same PII input always produces the same token, so JOIN keys remain consistent across tables. The original data is never stored in plaintext anywhere in the pipeline, satisfying both the masking and referential integrity requirements simultaneously.

Why the others fail:

• A ("cryptogenic tokens") stores the original unmasked data in a separate bucket, creating a second attack surface - the locked-down bucket can still be breached, so PII remains accessible.
• B (redaction + unredacted bucket) destroys the data's usefulness as a join key - [REDACTED] cannot be joined - and again stores raw PII in a bucket.
• C (scan BigQuery tables) is reactive and operates after data has already landed unmasked in BigQuery; it also doesn't address the streaming ingestion phase or guarantee join-key consistency.

Memory tip: Associate referential integrity with deterministic tokenization - if you need the same value to produce the same masked result every time (for JOINs), you need a cryptographic token, not random masking or redaction. The word "pseudonym" in the answers is your cue: a good pseudonym is consistent, but only D applies it cryptographically without storing the original.

No community discussion yet for this question.