An enterprise financial organization is designing an ingestion pipeline to integrate continuous, high-volume transactional logs from an on-premises database into a secured BigQuery data warehouse. The technical, analytical, and compliance requirements are as follows: Throughput & Network: High-bandwidth, low-latency private connectivity to transfer high-velocity streaming records into Google Cloud. Client-Side Data Protection: Highly sensitive columns (such as credit card numbers) must be encrypted on-premises prior to ingestion into the cloud. Granular Decryption & Masking: In BigQuery, authorized fraud investigators must be able to run SQL queries to decrypt the protected data on-demand, whereas general analysts querying the same table must only see dynamically masked values. Key Governance: Encryption keys must be hardware-backed with Cloud HSM and centrally managed via customer-managed encryption keys (CMEK). Which ingestion and security design should the data engineering team implement?

Establish a Dedicated Interconnect connection; encrypt sensitive fields on-premises using the Tink library with Cloud HSM-wrapped keys; ingest the encrypted columns and wrapped keys into BigQuery; configure policy tags with dynamic data masking and grant the Fine-Grained Reader role to authorized investigators to use BigQuery AEAD decryption SQL functions.: ### What the Recommended Architecture Is This architecture combines high-throughput private network connectivity with **client-side envelope encryption** and native **BigQuery column-level security** to establish an end-to-end secured data ingestion and analytics pipeline. ### How It Meets the Requirements * **High-Bandwidth, Low-Latency Networking:** **Dedicated Interconnect** provides a direct physical link between the on-premises network and Google Cloud, providing the high throughput and predictable latency necessary for high-velocity transactional data. * **Client-Side Encryption:** Utilizing the **Tink encryption library** on-premises allows the organization to encrypt sensitive fields (like credit card numbers) before data departs the private data center. Tink utilizes **Data Encryption Keys (DEKs)** that are wrapped by a **Key Encryption Key (KEK)** managed in **Cloud HSM** as a symmetric **CMEK**. * **Granular Decryption and Dynamic Masking:** Ingesting both the ciphertext and the wrapped DEK into BigQuery enables authorized users to perform **AEAD decryption** (`AEAD.DECRYPT_STRING`) at query runtime. Applying **policy tags** with **dynamic data masking** ensures unauthorized general analysts only see masked values, while fraud analysts with the **Fine-Grained Reader** (`roles/datacatalog.categoryFineGrainedReader`) role can access unmasked data and invoke AEAD decryption functions. * **Hardware-Backed Key Governance:** The KEKs are hosted in **Cloud HSM**, satisfying FIPS-compliant hardware security standards with automated 30-day rotation. ### Key Advantages * **Dual-Access Control:** Decryption requires permissions to both the BigQuery table and the underlying Cloud KMS/HSM cryptographic key. * **Zero Plaintext Exposure:** Sensitive columns are never exposed in cleartext across the network perimeter or to unprivileged warehouse users. * **Standard SQL Usability:** Analysts leverage native GoogleSQL AEAD functions directly inside BigQuery without custom external services. ### Why This Is Optimal This pattern aligns with the Google Cloud Secured Data Warehouse blueprint for external data sources, addressing throughput, client-side compliance, and granular role-based SQL access controls.

Secure Onprem Bigquery Ingestion Tink Aead | professional-cloud-data-engineer

Secure Onprem Bigquery Ingestion Tink Aead

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise financial organization is designing an ingestion pipeline to integrate continuous, high-volume transactional logs from an on-premises database into a secured BigQuery data warehouse.

The technical, analytical, and compliance requirements are as follows:

Throughput & Network: High-bandwidth, low-latency private connectivity to transfer high-velocity streaming records into Google Cloud.
Client-Side Data Protection: Highly sensitive columns (such as credit card numbers) must be encrypted on-premises prior to ingestion into the cloud.
Granular Decryption & Masking: In BigQuery, authorized fraud investigators must be able to run SQL queries to decrypt the protected data on-demand, whereas general analysts querying the same table must only see dynamically masked values.
Key Governance: Encryption keys must be hardware-backed with Cloud HSM and centrally managed via customer-managed encryption keys (CMEK).

Which ingestion and security design should the data engineering team implement?

Establish an IPsec Cloud VPN tunnel; ingest raw plaintext transaction records into Cloud Storage; schedule a Sensitive Data Protection (DLP) de-identification inspection job to rewrite objects using customer-supplied encryption keys (CSEK); load the output into BigQuery tables with row-level security policies.

Establish a Dedicated Interconnect connection; encrypt sensitive fields on-premises using the Tink library with Cloud HSM-wrapped keys; ingest the encrypted columns and wrapped keys into BigQuery; configure policy tags with dynamic data masking and grant the Fine-Grained Reader role to authorized investigators to use BigQuery AEAD decryption SQL functions.

Stream records over public HTTPS endpoints to Cloud Run functions; tokenize sensitive identifiers irreversibly using cryptographic hashing; write files into Cloud Storage using BigLake tables; apply BigQuery Storage Read API ACLs to govern field access.

Deploy an Apache Sqoop cluster on Cloud Dataproc over Dedicated Interconnect; batch load relational data directly into BigQuery; apply column-level encryption using Cloud KMS software keys; configure IAM table-level permissions to restrict unauthorized analyst access.

Professional Cloud Data Engineer

Secure Onprem Bigquery Ingestion Tink Aead

Related questions