An enterprise is designing an automated data ingestion pipeline to process transaction records before storing them in BigQuery for analytics. The incoming records include sensitive commercial and personally identifiable information (PII) with the following specific requirements: Credit card numbers: Must be pseudonymized so that legacy processing systems expecting a 16-digit numeric string can still parse the data without schema errors, while allowing authorized security teams to reverse the tokenization back to the original number. Customer age: Must be generalized into discrete numerical ranges to reduce re-identification risk while preserving utility for demographic reporting. Customer support notes: Contain unstructured free-form text that must be automatically scanned for unforeseen sensitive data (such as email addresses and phone numbers) and obfuscated. Which combination of Sensitive Data Protection (Cloud DLP) de-identification transformations should the cloud architect specify in the de-identification template?

Use Format-Preserving Encryption (FPE-FFX) for credit card numbers, fixed-size bucketing for customer age, and an infoType inspection transformation with character masking for support notes.: ### What This Solution Is **Sensitive Data Protection** (formerly Cloud DLP) provides configurable de-identification transformations that allow organizations to obfuscate, tokenize, mask, or generalize sensitive data at scale across streaming and batch pipelines. ### How It Meets the Requirements * **Credit Card Numbers (Reversible and Schema Compatible)**: **Format-Preserving Encryption (FPE)** in **FFX mode** encrypts data while preserving both the original string length (e.g., 16 digits) and the character set (numeric characters). Because it is a two-way cryptographic tokenization method, authorized administrators using the corresponding wrapped token encryption key in **Cloud KMS** can reverse the ciphertext to restore the original credit card number. * **Customer Age (Generalization)**: **Fixed-size bucketing** is a primitive transformation that groups individual continuous values into discrete categorical ranges (such as ages 20–29, 30–39), mitigating quasi-identifier disclosure risk while maintaining demographic aggregate value. * **Unstructured Support Notes (Automated Discovery & Masking)**: For free-form text fields where sensitive infoTypes are not isolated to designated columns, an **`infoTypeTransformations`** configuration inspects the text using built-in detectors (such as `EMAIL_ADDRESS` and `PHONE_NUMBER`) and applies **character masking** to replace matching tokens with characters like `#` or `*`. ### Key Advantages and Capabilities * **Backward Compatibility**: Allows downstream legacy systems to process tokenized credit card fields without modifying strict schema definitions or character-length limits. * **Two-Way Cryptographic Integrity**: Preserves referential integrity across datasets for join operations while enabling full re-identification when legally required. * **Fine-Grained Contextual Detection**: Scans unstructured text payloads with over 100+ pre-built classifiers to eliminate unintended leakage in notes or comments. * **Centralized Policy Management**: Encapsulates transformation rules into reusable **Sensitive Data Protection templates**, decoupling security logic from data pipelines. ### Why This Is Optimal This architecture accurately satisfies all operational and structural constraints. It avoids breaking downstream schema constraints on legacy applications while maintaining strong de-identification and risk-mitigation standards across structured and unstructured data formats.

StudyCerts

Sensitive Data Protection Dlp Deidentification Transformations | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Sensitive Data Protection Dlp Deidentification Transformations

Section: Commercial (e.g., sensitive data such as credit card information handling and personally identifiable information [PII])

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing an automated data ingestion pipeline to process transaction records before storing them in BigQuery for analytics. The incoming records include sensitive commercial and personally identifiable information (PII) with the following specific requirements:

Credit card numbers: Must be pseudonymized so that legacy processing systems expecting a 16-digit numeric string can still parse the data without schema errors, while allowing authorized security teams to reverse the tokenization back to the original number.
Customer age: Must be generalized into discrete numerical ranges to reduce re-identification risk while preserving utility for demographic reporting.
Customer support notes: Contain unstructured free-form text that must be automatically scanned for unforeseen sensitive data (such as email addresses and phone numbers) and obfuscated.

Which combination of Sensitive Data Protection (Cloud DLP) de-identification transformations should the cloud architect specify in the de-identification template?

Use Format-Preserving Encryption (FPE-FFX) for credit card numbers, fixed-size bucketing for customer age, and an infoType inspection transformation with character masking for support notes.

Use Deterministic Encryption (DE) with AES-SIV for credit card numbers, date shifting for customer age, and cryptographic hashing for support notes.

Use BigQuery Dynamic Data Masking policy tags for credit card numbers, Cloud KMS envelope encryption for customer age, and Data Catalog column tagging for support notes.

Use Cryptographic Hashing (HMAC-SHA-256) for credit card numbers, primitive character masking for customer age, and replacement transformations for support notes.

Professional Cloud Architect

Sensitive Data Protection Dlp Deidentification Transformations

Related questions