A payment processing company stores credit card numbers in a BigQuery table for transaction analysis. They need to encrypt the credit card numbers so that they are not stored in plaintext, but the encrypted values must retain the same format and length (e.g., 16-digit numbers) so that existing applications and reports that expect numeric strings continue to work without modification. What should they do?

Use SDP format-preserving encryption (FPE) to encrypt the credit card numbers, preserving the original format and length.

Use SDP pseudonymization with a cryptographic key to replace credit card numbers with tokens of the same length.

Use a Cloud Function to hash the credit card numbers with SHA-256 and store the truncated hash.

Use standard AES encryption with a customer-managed key and store the encrypted values as base64 strings.

A financial services company receives customer support emails that contain sensitive information such as credit card numbers and social security numbers. They want to automatically redact this information from the emails before storing them in a Cloud Storage bucket for archival. The redaction must be irreversible and must not alter the rest of the email content. What should they do?

Use Cloud DLP's pseudonymization transformation to replace sensitive values with a cryptographic token.

Use the Sensitive Data Protection API to inspect the email text and apply a redaction transformation that replaces detected values with a placeholder like [REDACTED].

Use a Cloud Dataflow pipeline with a custom UDF that uses regular expressions to find and replace credit card numbers and social security numbers.

Store the emails in a Cloud Storage bucket with a lifecycle rule that automatically deletes objects after 30 days.

A database administrator needs to ensure that a Cloud SQL instance is only accessible from within a VPC network and not from the public internet. Which configuration should be used?

Public IP with authorized networks

Google CloudProfessional Cloud Security Engineer

Domain 3Objective 1

3.1 Protecting Sensitive Data and Preventing Data Loss PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Part of the Ensuring data protection domain, which accounts for 23% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

29questions here

6free pages

10concepts

23%of the exam

Questions 16–20

16foundation · easy
An organization wants to automatically rotate a database password stored in Secret Manager every 30 days. What should be configured to achieve this?
Select an answer first
17foundation · easy
An organization wants to grant a service account write access to objects in a specific Cloud Storage bucket. Which IAM role should be assigned to the service account?
Select an answer first
18application · medium
A payment processing company stores credit card numbers in a BigQuery table for transaction analysis. They need to encrypt the credit card numbers so that they are not stored in plaintext, but the encrypted values must retain the same format and length (e.g., 16-digit numbers) so that existing applications and reports that expect numeric strings continue to work without modification. What should they do?
Select an answer first
19application · medium
A financial services company receives customer support emails that contain sensitive information such as credit card numbers and social security numbers. They want to automatically redact this information from the emails before storing them in a Cloud Storage bucket for archival. The redaction must be irreversible and must not alter the rest of the email content. What should they do?
Select an answer first
20foundation · easy
A database administrator needs to ensure that a Cloud SQL instance is only accessible from within a VPC network and not from the public internet. Which configuration should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

3.1 Protecting Sensitive Data and Preventing Data Loss PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

An organization wants to automatically rotate a database password stored in Secret Manager every 30 days. What should be configured to achieve this?

An organization wants to grant a service account write access to objects in a specific Cloud Storage bucket. Which IAM role should be assigned to the service account?

A database administrator needs to ensure that a Cloud SQL instance is only accessible from within a VPC network and not from the public internet. Which configuration should be used?

Keep studying — Ensuring data protection