Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Google Cloud Certified Professional Cloud Security Engineer · Google Cloud
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Both A & D will do the job. But, A is preferred as the data is PII and needs to be secure. https://cloud.google.com/dlp/docs/pseudonymization#how-tokenization-works Why A is not a apt response: https://cloud.google.com/bigquery/docs/column-data-masking-intro The SHA-256 function used in data masking is type preserving, so the hash value it returns has the same data type as the column value. SHA-256 is a deterministic hashing function; an initial value always resolves to the same hash value. However, it does not require encryption keys. This makes it possible for a malicious actor to use a brute force attack to determine the original value, by running all possible original values through the SHA-256 algorithm and seeing which one produces a hash that matches the hash returned by data masking.
D, as tokenization supports re-identification for the HR team
B is okay Data redaction, as opposed to data masking or tokenization, completely removes or replaces the sensitive fields, making it so that the operations teams cannot see the sensitive information. This ensures that the sensitive data is only available to the Human Resources team on a need-to-know basis, as per the privacy regulations. The Cloud Data Loss Prevention API is able to inspect and redact data, making it a suitable choice for this task.