3.1 Protecting Sensitive Data and Preventing Data Loss PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A financial application stores credit card numbers in a database. The application requires that encrypted values maintain the same length and character set as the original numbers so that existing database schemas and validation logic continue to work. Which SDP de-identification technique should be used?

   • ADate shifting
   • BFormat-preserving encryption (FPE)
   • CPseudonymization
   • DRedaction
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the key characteristic of pseudonymization that distinguishes it from redaction in Sensitive Data Protection (SDP)?

   • APseudonymization removes data, while redaction preserves it
   • BPseudonymization only works on images, while redaction works on text
   • CPseudonymization is irreversible, while redaction is reversible
   • DPseudonymization is reversible, while redaction is not
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A legal firm stores client documents in a Cloud Storage bucket. They need to ensure that any documents containing personally identifiable information (PII) are automatically redacted before being shared with external partners. The documents are in PDF format. What should they do?

   • AUse Cloud Storage object lifecycle rules to automatically delete any PDFs that contain PII.
   • BUse SDP to inspect the PDF files in the bucket, and apply a redaction transformation to the content before sharing.
   • CUse a Cloud Function to convert the PDFs to text, then use SDP to redact the text, and store the redacted text files.
   • DUse a Cloud Dataflow pipeline to parse the PDFs and apply a custom redaction algorithm.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A data science team needs to query a BigQuery table that contains a column of customer phone numbers. The team should not be able to see the full phone numbers, but they need to be able to see the area code for analysis. The company wants to enforce this at the database level, so that any query from the team automatically masks the phone numbers. What should they do?

   • ACreate a policy tag on the phone number column with a data masking policy that uses a custom masking function to show only the area code.
   • BUse a Cloud Function to periodically copy the table to a new table with the phone number column removed, and grant the team access to the new table.
   • CCreate an authorized view that uses the SDP API to redact the phone number column, and grant the team access to the view instead of the underlying table.
   • DGrant the team the BigQuery Data Editor role on the dataset and create a separate table with only the area code column.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An application running on Compute Engine needs to retrieve information about the instance, such as its zone and project ID. What should the application use to obtain this information?

   • ACloud KMS
   • BMetadata server
   • CSecret Manager
   • DCloud Storage
   Reveal Solution Discussion Select an answer first