An enterprise data architect is designing an automated de-identification pipeline using Sensitive Data Protection before ingesting a sensitive dataset into BigQuery. The source dataset contains four key fields with distinct compliance, system, and analytical constraints: account_number: A fixed 10-digit numeric string that must be ingested by a legacy downstream application requiring strict 10-digit numeric format preservation, while also supporting two-way re-identification by security administrators. user_id: A customer identifier required for multi-table analytical joins across historical datasets; it requires two-way re-identification and maximum cryptographic security without character set or length preservation constraints. user_age: A quasi-identifier that must be generalized into discrete intervals (such as 20–29, 30–39) to reduce re-identification risk under k-anonymity requirements while retaining demographic utility. user_pin: A 4-digit secret that must never be reversible under any circumstances, but must maintain referential integrity across analytical queries. Which combination of Sensitive Data Protection transformational methods should the architect select for each respective column?

account_number: Format-preserving encryption in FFX mode; user_id: Deterministic encryption using AES-SIV; user_age: Fixed-size bucketing; user_pin: Cryptographic hashing with HMAC-SHA-256: ### What the Recommended Configuration Is This architecture pairs specialized cryptographic and generalization techniques in **Sensitive Data Protection** to balance data utility, schema compatibility, and privacy guarantees across diverse field requirements. ### How It Meets Each Requirement - **`account_number` (Format-Preserving Encryption with FFX)**: `CryptoReplaceFfxFpeConfig` encrypts values while preserving the exact 10-digit numeric character set and character length. This prevents schema violations and parsing exceptions in legacy downstream applications while enabling two-way re-identification with a Cloud KMS wrapped key. - **`user_id` (Deterministic Encryption with AES-SIV)**: `CryptoDeterministicConfig` uses AES in Synthetic Initialization Vector mode to yield identical ciphertext for identical inputs across the dataset. This preserves referential integrity for multi-table BigQuery analytical joins and allows authorized two-way re-identification, providing stronger security guarantees than FPE when length and alphabet preservation are not required. - **`user_age` (Fixed-Size Bucketing)**: `FixedSizeBucketingConfig` implements generalization by mapping individual continuous integer values into discrete ranges (such as bucket intervals of 10). This reduces uniqueness across demographic quasi-identifiers to satisfy *k*-anonymity while preserving analytical utility. - **`user_pin` (Cryptographic Hashing)**: `CryptoHashConfig` computes an HMAC-SHA-256 digest on the input. This is a one-way tokenization method that cannot be reversed or de-tokenized, satisfying non-reversibility while preserving referential integrity. ### Key Advantages - **Legacy Interoperability**: Preserves exact field lengths and alphabets where legacy parsers demand strict typing. - **Cryptographic Robustness**: Applies AES-SIV for general pseudonymization where format constraints do not apply. - **Irreversible Protection**: Eliminates insider threat on secrets through keyed cryptographic hashing. - **Quantifiable Privacy**: Reduces re-identification risk by eliminating rare demographic outliers with bucketing. ### Why This Is Optimal This selection aligns each column with the exact transformational primitive that provides the required mathematical guarantees without unnecessary security compromises or breaking downstream schema dependencies.

Sensitive Data Protection Deidentification Technique Selection | professional-cloud-data-engineer

Sensitive Data Protection Deidentification Technique Selection

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise data architect is designing an automated de-identification pipeline using Sensitive Data Protection before ingesting a sensitive dataset into BigQuery. The source dataset contains four key fields with distinct compliance, system, and analytical constraints:

account_number: A fixed 10-digit numeric string that must be ingested by a legacy downstream application requiring strict 10-digit numeric format preservation, while also supporting two-way re-identification by security administrators.
user_id: A customer identifier required for multi-table analytical joins across historical datasets; it requires two-way re-identification and maximum cryptographic security without character set or length preservation constraints.
user_age: A quasi-identifier that must be generalized into discrete intervals (such as 20–29, 30–39) to reduce re-identification risk under k-anonymity requirements while retaining demographic utility.
user_pin: A 4-digit secret that must never be reversible under any circumstances, but must maintain referential integrity across analytical queries.

Which combination of Sensitive Data Protection transformational methods should the architect select for each respective column?

Professional Cloud Data Engineer

Sensitive Data Protection Deidentification Technique Selection

Related questions