Google Professional Cloud Security Engineer Exam - Topic 2 Question 60 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 60
Topic #: 2

[All Professional Cloud Security Engineer Questions]

You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on-premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes. Which components should you use in your solution? (Choose two.)

ASecret Manager

BCloud Key Management Service

CCloud Data Loss Prevention with cryptographic hashing

DCloud Data Loss Prevention with automatic text redaction

ECloud Data Loss Prevention with deterministic encryption using AES-SIV

Show Suggested Answer

Suggested Answer: B

https://cloud.google.com/storage/docs/public-access-prevention

Public access prevention protects Cloud Storage buckets and objects from being accidentally exposed to the public. If your bucket is contained within an organization, you can enforce public access prevention by using the organization policy constraint storage.publicAccessPrevention at the project, folder, or organization level.

by Felix at Feb 05, 2023, 03:14 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Karima

4 months ago

C and E are the best choices for handling PII securely.

upvoted 0 times

...

Shonda

4 months ago

A and B are not the right fit for this scenario.

upvoted 0 times

...

Selma

4 months ago

Wait, can we really re-identify data after using encryption? Sounds risky!

upvoted 0 times

...

Millie

4 months ago

I think D is also a good option, but not for re-identification.

upvoted 0 times

...

Valentin

4 months ago

Definitely going with C and E for this!

upvoted 0 times

...

Angelo

5 months ago

I feel like Cloud DLP is definitely the right direction, but I can't recall if I should go with the cryptographic hashing or the deterministic encryption option for this scenario.

upvoted 0 times

...

Avery

5 months ago

I practiced a similar question where we had to choose between encryption methods, and I think Secret Manager might not be relevant here since it’s more about storing secrets than redacting data.

upvoted 0 times

...

India

5 months ago

I think using Cloud DLP with deterministic encryption could work since it allows for re-identification, but I’m a bit confused about the difference between that and cryptographic hashing.

upvoted 0 times

...

Mica

5 months ago

I remember studying about data redaction techniques, but I'm not sure if automatic text redaction is the best choice for re-identifying data later.

upvoted 0 times

...

Naomi

5 months ago

Hmm, the question is asking about the recommended operating model, but there are a few options that seem plausible. I'll need to carefully consider the context provided.

upvoted 0 times

...

Renea

5 months ago

Hmm, I'm a bit confused. The question mentions that the Playbook is for manual reduction of vCPU, but it's not clear why it's failing on this specific VM. I'll need to think through the possible reasons.

upvoted 0 times

...

Nobuko

5 months ago

I'm a little confused on this one. I know observability is about being able to see what's happening inside the system, but I'm not sure which of these options best captures that. I might need to review my notes on testability characteristics before answering.

upvoted 0 times

...

Ressie

10 months ago

Wait, we're supposed to choose two options? I was just gonna go with the first one that sounded the most techno-babble-y.

upvoted 0 times

...

Bettina

10 months ago

Samantha

upvoted 0 times

Kris

8 months ago

C) Cloud Data Loss Prevention with cryptographic hashing and E) Cloud Data Loss Prevention with deterministic encryption using AES-SIV

upvoted 0 times

...

Dominga

9 months ago

B) Cloud Key Management Service and D) Cloud Data Loss Prevention with automatic text redaction

upvoted 0 times

...

Keneth

9 months ago

A) Secret Manager and C) Cloud Data Loss Prevention with cryptographic hashing

upvoted 0 times

...

Gianna

10 months ago

Well, this is a no-brainer. I'm picking C and D all the way. Automatic text redaction is the way to go!

upvoted 0 times

...

Muriel

10 months ago

Alright, time to put on my security hat. I'm leaning towards C and E - gotta keep that PII under lock and key, you know?

upvoted 0 times

Izetta

9 months ago

E) Cloud Data Loss Prevention with deterministic encryption using AES-SIV is a strong choice for re-identifying the data.

upvoted 0 times

...

Mozelle

9 months ago

C) Cloud Data Loss Prevention with cryptographic hashing is a must for protecting PII.

upvoted 0 times

...

Erasmo

9 months ago

A) Secret Manager sounds like a good option for securing the data.

upvoted 0 times

...

Jerry

10 months ago

Ooh, this is a good one! I think I'd use both Cloud Data Loss Prevention and Secret Manager to really lock down that sensitive data.

upvoted 0 times

Santos

8 months ago

Combining both components will ensure the data is protected and can still be used for analytics purposes.

upvoted 0 times

...

Eliz

9 months ago

Secret Manager can securely store and manage API keys, passwords, certificates, and other sensitive data.

upvoted 0 times

...

Brice

9 months ago

I agree, using Cloud Data Loss Prevention with cryptographic hashing will help obfuscate the PII.

upvoted 0 times

...

Salena

11 months ago

Hmm, this seems like a tricky one. I'd definitely go with Cloud Data Loss Prevention, but I'm not sure if I should choose the cryptographic hashing or the deterministic encryption option.

upvoted 0 times

Nadine

10 months ago

Perfect, that should provide a secure solution for handling the PII in your Google Cloud environment.

upvoted 0 times

...

Georgeanna

10 months ago

Great idea! With those two components, you should be able to redact and re-identify the sensitive data.

upvoted 0 times

...

Phil

10 months ago

That's a good choice. I would also suggest using Cloud Data Loss Prevention with automatic text redaction.

upvoted 0 times

...

Kerry

10 months ago

I think you should go with Cloud Data Loss Prevention with deterministic encryption using AES-SIV.

upvoted 0 times

...

Richelle

11 months ago

I'm not sure about using Cloud Data Loss Prevention with automatic text redaction. It might not be the best option for this scenario.

upvoted 0 times

...

Zona

11 months ago

I agree with Billy. We can also use Cloud Data Loss Prevention with deterministic encryption using AES-SIV to re-identify the data for analytics purposes.

upvoted 0 times

...

Billy

11 months ago

I think we should use Cloud Data Loss Prevention with cryptographic hashing to obfuscate the PII.

upvoted 0 times

...