You are preparing an organization-wide dataset. You need to preprocess customer data stored in a restricted bucket in Cloud Storage. The data will be used to create consumer analyses. You need to…

Question

Options

• AUse Dataflow and the Cloud Data Loss Prevention API to mask sensitive data. Write the processed data in BigQuery.
• BUse customer-managed encryption keys (CMEK) to directly encrypt the data in Cloud Storage. Use federated queries from BigQuery. Share the encryption key
• CUse the Cloud Data Loss Prevention API and Dataflow to detect and remove sensitive fields from the data in Cloud Storage. Write the filtered data in BigQuery.
• DUse Dataflow and Cloud KMS to encrypt sensitive fields and write the encrypted data in BigQuery. Share the encryption key by following the principle of least

• A
  82% (45)
• B
  5% (3)
• C
  2% (1)
• D
  11% (6)

Explanation

Option A is correct because masking sensitive data with the Cloud Data Loss Prevention (DLP) API preserves the data's analytical utility while replacing or obfuscating identifying information - this satisfies both the consumer analysis requirement and data privacy compliance simultaneously.

Option C is wrong because removing sensitive fields destroys data that may be needed for the analyses; masking is the appropriate privacy technique when the data still needs to be used, not deletion.

Option B is wrong because sharing encryption keys undermines the entire purpose of encryption - if recipients have the key, the data is effectively unprotected, and federated queries on unmasked, still-sensitive data don't satisfy privacy requirements.

Option D is wrong for the same key-sharing reason: writing encrypted data to BigQuery and then sharing the decryption key negates the protection, and "principle of least privilege" doesn't fix the fundamental problem of distributing a key to multiple consumers.

Memory tip: When you see "data privacy + analytics," think DLP + mask (not delete, not encrypt-and-share). The word mask is your signal - it hides PII while keeping the data useful, which is the classic GCP privacy pattern for datasets that need to be shared or analyzed.

No community discussion yet for this question.