An enterprise is preparing customer service datasets stored in Google Cloud to train a machine learning model for sentiment analysis. The datasets include structured customer identifier fields (such as customer email addresses) alongside unstructured freeform text fields (such as customer support notes and reviews). The machine learning engineering team has specified the following requirements: Referential integrity must be preserved so that multiple interactions and reviews from the same individual customer can still be grouped and aggregated. Unstructured text columns must be scanned to identify and mask intermittent personally identifiable information (PII), such as phone numbers and government-issued identification numbers. Plaintext sensitive PII must not be exposed to the model training and development environment. Which Sensitive Data Protection (SDP) architecture should you implement?

Configure a Sensitive Data Protection de-identification template that performs cryptographic tokenization on the structured email identifier field and applies masking transformations on detected sensitive infoTypes within the freeform text fields.: ### What the Solution Is **Sensitive Data Protection (SDP)** provides automated de-identification and transformation capabilities designed to sanitize structured and unstructured data before it is ingested by downstream workloads such as AI/ML model training pipelines. Using custom **de-identification templates**, SDP can apply field-level cryptographic pseudonymization (tokenization) as well as content-level inspection and masking on unstructured text. ### How It Meets the Requirements - **Preserving Referential Integrity:** Applying **cryptographic tokenization** (pseudonymization) to the structured `email` field replaces sensitive identifiers with consistent surrogate tokens. Because identical inputs generate identical surrogate tokens when using the same crypto key, the ML team can group, join, and aggregate records belonging to the same user without seeing the underlying email address. - **Masking Intermittent PII in Freeform Text:** SDP evaluates freeform strings against built-in or custom **infoType detectors** (such as `PHONE_NUMBER` and `US_SOCIAL_SECURITY_NUMBER`) and applies **masking transformations** (e.g., replacing values with `***` or surrogate tags) directly to detected sensitive text. - **Protecting the AI Training Environment:** Sanitizing the raw dataset before exporting it to the ML development environment ensures compliance with data privacy regulations by minimizing exposure of raw PII. ### Key Advantages and Capabilities - **Format-Preserving Encryption (FPE) and Tokenization:** Maintains data utility and relational joins across multiple tables and training datasets. - **Automated InfoType Detection:** Scans complex unstructured freeform text to identify sensitive entities using contextual rules and machine learning. - **Template Reusability:** De-identification templates can be managed centrally, version-controlled, and reused across batch pipelines (Dataflow/Data Fusion) and remote BigQuery SQL functions. - **Fine-Grained Obfuscation:** Allows different transformation rules for distinct columns and data classifications within the same processing job. ### Why This Is Optimal This solution strikes the optimal balance between **data privacy** and **data utility**. Pure redaction or record deletion would destroy the relational links required for customer-level sentiment modeling, whereas tokenization preserves structural analytical value while eliminating cleartext PII risk.

StudyCerts

Sensitive Data Protection Ai Pii Masking Tokenization | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Sensitive Data Protection Ai Pii Masking Tokenization

Section: Securing AI (e.g., Model Armor, Sensitive Data Protection, and secure model deployment)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is preparing customer service datasets stored in Google Cloud to train a machine learning model for sentiment analysis. The datasets include structured customer identifier fields (such as customer email addresses) alongside unstructured freeform text fields (such as customer support notes and reviews).

The machine learning engineering team has specified the following requirements:

Referential integrity must be preserved so that multiple interactions and reviews from the same individual customer can still be grouped and aggregated.
Unstructured text columns must be scanned to identify and mask intermittent personally identifiable information (PII), such as phone numbers and government-issued identification numbers.
Plaintext sensitive PII must not be exposed to the model training and development environment.

Which Sensitive Data Protection (SDP) architecture should you implement?

Configure a Sensitive Data Protection de-identification template that performs cryptographic tokenization on the structured email identifier field and applies masking transformations on detected sensitive infoTypes within the freeform text fields.

Configure a Sensitive Data Protection inspection job with record suppression rules configured to drop any record that contains a customer email address or detected sensitive infoTypes.

Apply BigQuery policy tags with column-level security and IAM access controls to restrict access to the customer email column and freeform text review columns.

Enable Sensitive Data Protection automated discovery to generate data profiles and export the resulting data risk metrics to Security Command Center and Dataplex.

Professional Cloud Architect

Sensitive Data Protection Ai Pii Masking Tokenization

Related questions