Discuss Google Associate Data Practitioner Exam Topic 4 Question 1

Your organization stores highly personal data in BigQuery and needs to comply with strict data privacy regulations. You need to ensure that sensitive data values are rendered unreadable whenever an employee leaves the organization. What should you do?

AUse AEAD functions and delete keys when employees leave the organization.

BUse dynamic data masking and revoke viewer permissions when employees leave the organization.

CUse customer-managed encryption keys (CMEK) and delete keys when employees leave the organization.

DUse column-level access controls with policy tags and revoke viewer permissions when employees leave the organization.

Suggested Answer: C

Using customer-managed encryption keys (CMEK) allows you to encrypt highly sensitive data in BigQuery with encryption keys managed by your organization. When an employee leaves the organization, you can render the data unreadable by deleting or revoking access to the encryption keys associated with the data. This approach ensures compliance with strict data privacy regulations by making the data inaccessible without the encryption keys, providing strong control over data access and security.

Get Premium Associate Data Practitioner Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Ryan 11 months ago

Not sure if deleting keys is enough, what if they still have access?

Florinda 11 months ago

Definitely going with C, CMEK is crucial for compliance!

Ira 11 months ago

Wait, can dynamic data masking really protect sensitive data like that?

Micaela 11 months ago

I disagree, AEAD functions (A) seem more secure for this scenario.

Maira 12 months ago

I think option C is the best choice for key management.

Josephine 12 months ago

Option D seems like a good approach with column-level access controls, but I'm not confident if revoking permissions alone is enough for compliance.

Carlton 1 year ago

I feel like CMEK in option C could be the right choice since deleting keys would make the data unreadable, but I need to double-check the specifics.

Maile 1 year ago

I remember practicing with dynamic data masking, so option B might be relevant, but it doesn't seem like it fully addresses the data privacy issue.

Mirta 1 year ago

I think option A sounds familiar, but I'm not entirely sure how AEAD functions work in this context.

Lashonda 1 year ago

AEAD functions and key deletion sounds promising. I'll make sure to double-check the details on that approach.

Miss 1 year ago

Dynamic data masking could be a good solution, but I'm not sure if that fully addresses the requirement to render the data unreadable.

Kina 1 year ago

Okay, I think I've got it. Using CMEK and deleting the keys when employees leave seems like the most secure option.

Xochitl 1 year ago

Hmm, I'm a bit confused by the question. Let me re-read it and see if I can figure out the best approach.

Jacklyn 1 year ago

This seems like a tricky one. I'll need to think through the different options carefully.

Margarita 2 years ago

Ooh, tricky one. I'm leaning towards B. Revoking permissions is a must, and dynamic masking is a nice extra layer of protection.

Annita 2 years ago

Ha! Reminds me of that time I accidentally deleted a whole database by mistake. Anyway, I'm going with D - gotta love those policy tags!

Mirta 2 years ago

↳ replying to Annita

Yeah, policy tags are great for controlling access to sensitive data.

Claribel 2 years ago

↳ replying to Annita

I think D is a good choice too, policy tags can be really helpful.

Nilsa 2 years ago

I'd say C is the answer. Deleting the encryption keys is the best way to make the data unreadable when employees leave.

Olen 2 years ago

↳ replying to Nilsa

I agree with you, A sounds like the most secure option for protecting sensitive data.

Florinda 2 years ago

↳ replying to Nilsa

I think A is the best option. Using AEAD functions and deleting keys ensures data security.

Sharika 2 years ago

I think using customer-managed encryption keys and deleting keys is the best way to go.

Armando 2 years ago

I'm not sure, I think using dynamic data masking could also be a good solution.

Danilo 2 years ago

I agree with Kenneth, that seems like the most secure option.

Denny 2 years ago

Definitely D. Dynamic data masking and AEAD functions are good, but policy tags and access controls give you the most control.

Annmarie 2 years ago

↳ replying to Denny

I think using a combination of column-level access controls and CMEK would be the most secure option.

Arminda 2 years ago

↳ replying to Denny

That's true, CMEK could provide an extra layer of security for the sensitive data.

Margo 2 years ago

↳ replying to Denny

But wouldn't using customer-managed encryption keys (CMEK) also be a good way to protect the data?

Roselle 2 years ago

↳ replying to Denny

I agree, D seems like the best option for controlling access to sensitive data.

Jerrod 2 years ago

Hmm, I think D is the way to go. Seems like the most robust solution to ensure data privacy.

Jutta 2 years ago

↳ replying to Jerrod

I think A might also be a good option to consider for ensuring data privacy.

Dalene 2 years ago

↳ replying to Jerrod

I agree, D does seem like a robust solution to protect sensitive data.

Kenneth 2 years ago

I think we should use AEAD functions and delete keys when employees leave.

Google Associate Data Practitioner Exam - Topic 4 Question 1 Discussion