Cloud Dlp Conditional Table Deidentification

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A healthcare analytics platform ingests tabular patient data through a streaming ingestion pipeline into BigQuery for visualization in Looker dashboards. To comply with privacy regulations, you must configure Cloud Data Loss Prevention (Cloud DLP / Sensitive Data Protection) to conditionally sanitize incoming records.

Specifically, you need to configure a de-identification pipeline where:

The PATIENT and FACTOID fields are inspected for PERSON_NAME infoTypes.
Detected names are replaced with the infoType token [PERSON_NAME].
The transformation is applied only to records where the AGE field is greater than 89.

How should you structure the DeidentifyConfig for this ingestion pipeline?

Configure RecordTransformations with a FieldTransformation targeting the PATIENT and FACTOID fields, attach an infoTypeTransformations using ReplaceWithInfoTypeConfig, and attach a RecordCondition evaluating AGE greater than 89.

Configure RecordTransformations with a FieldTransformation containing a CharacterMaskConfig on AGE, and define a RowCondition to drop rows matching PERSON_NAME.

Configure TransformationDetailsStorageConfig with a BucketingConfig on AGE and apply ReplaceWithInfoTypeConfig across all table columns globally inside an InspectConfig.

Configure InfoTypeTransformations using CryptoDeterministicConfig on PERSON_NAME and filter incoming messages in Pub/Sub using SQL filter expressions on the AGE attribute.

Professional Cloud Data Engineer

Cloud Dlp Conditional Table Deidentification

Related questions