What is the purpose of key rotation in Cloud KMS?

To periodically generate a new key version and use it for encrypting new data, while old versions can still decrypt existing data.

To change the encryption algorithm used by the key.

To delete old keys and replace them with new keys to prevent unauthorized access.

To move the key to a different location or region for compliance purposes.

Your organization has multiple teams that need to access BigQuery datasets. The finance team should only see financial data, and the marketing team should only see marketing data. You want to design a governance structure that minimizes administrative overhead. What should you do?

Create separate projects for each team and grant the BigQuery Data Viewer role at the project level.

Create a single dataset and use row-level security to filter data by team.

Create separate datasets for finance and marketing and grant each team the BigQuery Data Viewer role on their respective dataset.

Create a single dataset and grant both teams the BigQuery Data Viewer role on the entire dataset.

What is the purpose of assigning labels to resources like datasets and tables?

To define the retention policy for the data.

To organize and filter resources for management and cost tracking.

To encrypt the data stored in the resources.

To control access to the resources through IAM.

What is data sovereignty?

The concept that data is subject to the laws and regulations of the country where it is stored.

The ability to control who has access to data within an organization.

The practice of encrypting data to protect it from unauthorized access.

The process of backing up data to multiple regions for disaster recovery.

Your data pipeline ingests raw customer data that contains email addresses. For a marketing analytics use case, you need to join this data with other tables, but the analysts should not see the actual email addresses. What is the most appropriate technique to protect the PII while still allowing the join?

Use a deterministic hash of the email address as a join key and store the raw email in a separate, access-controlled table.

Encrypt the email addresses with a CMEK and store the encrypted values in the same table.

Mask the email addresses using BigQuery's data masking feature.

Remove the email addresses from the dataset entirely.

Google CloudProfessional Data Engineer

Domain 1Objective 1

1.1 Designing for Security and Compliance PROFESSIONAL-DATA-ENGINEER Practice Questions (Page 5)

Part of the Designing data processing systems domain, which accounts for ~22% of the PROFESSIONAL-DATA-ENGINEER exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

9concepts

~22%of the exam

Questions 21–25

21foundation · easy
What is the purpose of key rotation in Cloud KMS?
Select an answer first
22application · medium
Your organization has multiple teams that need to access BigQuery datasets. The finance team should only see financial data, and the marketing team should only see marketing data. You want to design a governance structure that minimizes administrative overhead. What should you do?
Select an answer first
23foundation · easy
What is the purpose of assigning labels to resources like datasets and tables?
Select an answer first
24foundation · easy
What is data sovereignty?
Select an answer first
25application · medium
Your data pipeline ingests raw customer data that contains email addresses. For a marketing analytics use case, you need to join this data with other tables, but the analysts should not see the actual email addresses. What is the most appropriate technique to protect the PII while still allowing the join?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-DATA-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-DATA-ENGINEER” is a trademark of its owner, used for identification only.