A healthcare analytics company stores de-identified patient data in BigQuery for research. A new compliance requirement mandates that they must automatically identify and classify any residual PII (e.g., names, email addresses, national IDs) that may have been left in the data during the de-identification process. They want to run this discovery on a recurring basis and have the results stored in a separate BigQuery table for audit. What should they do?

Enable BigQuery column-level security and add a policy tag that automatically redacts any detected PII in query results.

Export the BigQuery table to Cloud Storage and run a one-time SDP scan on the exported files, then manually review the findings.

Create a Sensitive Data Protection inspection job with a BigQuery data source, schedule it to run periodically, and set the output to write findings to a BigQuery table.

Use a Cloud Function triggered by a Pub/Sub message to query the BigQuery table and manually scan for PII using a regex pattern.

Google CloudProfessional Cloud Security Engineer

Domain 3Objective 1

3.1 Protecting Sensitive Data and Preventing Data Loss PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 6)

Part of the Ensuring data protection domain, which accounts for 23% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

29questions here

6free pages

10concepts

23%of the exam

Questions 26–29

26foundation · easy
A developer needs to store an API key securely and retrieve it at runtime from an application running on Compute Engine. Which Google Cloud service should be used?
Select an answer first
27application · medium
A healthcare analytics company stores de-identified patient data in BigQuery for research. A new compliance requirement mandates that they must automatically identify and classify any residual PII (e.g., names, email addresses, national IDs) that may have been left in the data during the de-identification process. They want to run this discovery on a recurring basis and have the results stored in a separate BigQuery table for audit. What should they do?
Select an answer first
28foundation · easy
When configuring a Sensitive Data Protection (SDP) discovery scan for a Cloud Storage bucket, which component determines the specific types of sensitive data (e.g., phone numbers, names) that the scan will look for?
Select an answer first
29foundation · easy
A data analyst needs to query a BigQuery table but should only see rows where the region column equals 'US'. The analyst should not be able to see other rows. Which BigQuery feature should be used to enforce this row-level restriction?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

3.1 Protecting Sensitive Data and Preventing Data Loss PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 6)

Questions 26–29

A developer needs to store an API key securely and retrieve it at runtime from an application running on Compute Engine. Which Google Cloud service should be used?

When configuring a Sensitive Data Protection (SDP) discovery scan for a Cloud Storage bucket, which component determines the specific types of sensitive data (e.g., phone numbers, names) that the scan will look for?

A data analyst needs to query a BigQuery table but should only see rows where the region column equals 'US'. The analyst should not be able to see other rows. Which BigQuery feature should be used to enforce this row-level restriction?

Keep studying — Ensuring data protection