3.1 Protecting Sensitive Data and Preventing Data Loss PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A media company stores user-uploaded profile pictures in a Cloud Storage bucket. The pictures are private and should only be accessible to the user who uploaded them. The company's web application needs to generate temporary URLs that allow users to view their own profile pictures without requiring them to authenticate to Google Cloud. What should they do?

   • AMake the bucket public and rely on the object names being unguessable.
   • BGenerate a signed URL for each object with a short expiration time and return it to the user in the web application.
   • CUse a Cloud Function to proxy the object and check the user's session cookie before returning the file.
   • DCreate a service account for each user and grant it access to the bucket, then use the service account's credentials in the web application.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A retail company needs to share customer purchase data with a third-party analytics firm for market research. The data contains customer email addresses that must not be exposed in plaintext, but the analytics firm needs to join this data with other datasets they receive from the company on a regular basis. The company wants to ensure that the same email address always maps to the same token across all datasets shared with the firm. What should they do?

   • AUse a Cloud Dataflow pipeline with a random salt to hash email addresses, and share the salt with the analytics firm.
   • BUse SDP redaction to replace email addresses with a fixed placeholder like [EMAIL].
   • CUse SDP pseudonymization with a cryptographic key to transform email addresses into deterministic tokens, and share the same key with the analytics firm so they can reverse the tokens if needed.
   • DUse SDP format-preserving encryption with a unique key per dataset, so each dataset has different tokens.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A security administrator wants to prevent an attacker who compromises a Compute Engine instance from using the metadata server to obtain sensitive information like service account tokens. What should be configured?

   • AUse a firewall rule to block metadata server access
   • BRemove IAM permissions from the service account
   • CUse a signed URL for metadata access
   • DDisable the metadata server for the instance
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A data engineer needs to remove credit card numbers from a text file before sharing it with a third party. The output should have the sensitive values completely removed so they cannot be recovered. Which Sensitive Data Protection (SDP) de-identification technique should be used?

   • APseudonymization
   • BRedaction
   • CDate shifting
   • DFormat-preserving encryption
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary advantage of using format-preserving encryption (FPE) over standard encryption in Sensitive Data Protection (SDP)?

   • AFPE does not require a key
   • BFPE maintains the original data format and length
   • CFPE is irreversible
   • DFPE is faster than standard encryption
   Reveal Solution Discussion Select an answer first