An organization is designing an automated Dataflow ingestion pipeline to de-identify sensitive structured records containing Personally Identifiable Information (PII) before storing them in BigQuery for analytics. The privacy compliance team establishes the following technical constraints: Identifier Tokenization: The 10-digit numerical patient_account_id column must retain referential integrity for analytical joins, remain reversible for authorized re-identification pipelines, and preserve its original 10-digit numeric character set to maintain backward compatibility with legacy schema validators. Quasi-Identifier Generalization: The patient_age column must be abstracted into discrete 10-year cohorts to mitigate re-identification risk while preserving population distribution metrics. Key Security: Plaintext cryptographic keys must not be exposed in configuration templates; all token encryption keys must be encrypted using Cloud Key Management Service (Cloud KMS). Which transformation configuration in Cloud Sensitive Data Protection (Cloud DLP) meets all of these requirements?

Configure RecordTransformations with a cryptoReplaceFfxFpeConfig specifying a kmsWrapped key and a numeric common alphabet for patient_account_id, and a fixedSizeBucketingConfig specifying a bucket size of 10 for patient_age: ### What Format-Preserving Encryption and Bucketing Are **Format-Preserving Encryption (FPE)** in **FFX mode** (`CryptoReplaceFfxFpeConfig`) and **Bucketed Generalization** (`FixedSizeBucketingConfig`) are primitive de-identification transformations provided by **Cloud Sensitive Data Protection** (Cloud DLP API). FPE performs two-way pseudonymization by encrypting values while strictly preserving the original character length and alphabet, whereas fixed-size bucketing generalizes continuous numerical values into bounded intervals. ### How It Meets the Requirements - **Identifier Tokenization (Format and Length Preservation)**: Setting `cryptoReplaceFfxFpeConfig` with a `common_alphabet` set to `NUMERIC` guarantees that the 10-digit account ID is transformed into a 10-digit numeric token, preventing validation failures in downstream legacy systems. - **Two-Way Reversibility & Referential Integrity**: FPE is deterministic and reversible. Identical inputs yield identical tokens across batch or streaming pipelines, allowing SQL joins in BigQuery while enabling authorized pipelines to de-tokenize the values using the decryption key. - **Quasi-Identifier Generalization**: The `fixedSizeBucketingConfig` with a bucket size of 10 replaces specific integer ages with 10-year ranges (e.g., `20:30`, `30:40`), minimizing re-identification risk while maintaining statistical utility. - **Key Security via Cloud KMS**: Specifying `kmsWrapped` under `cryptoKey` embeds an AES encryption key that is wrapped (encrypted) by a **Cloud KMS** key encryption key (KEK), ensuring plaintext secrets are never stored in templates or logs. ### Key Advantages and Capabilities - **Strict Schema Compliance**: Prevents application crashes in downstream consumers that enforce strict regex or length validations. - **Referential Integrity**: Guarantees consistent surrogate tokens across disparate datasets for analytics. - **Centralized Security Governance**: Enables IAM-governed de-identification and re-identification workflows without exposing raw cryptographic keys. - **Flexible Risk Mitigation**: Combines cryptographic pseudonymization with $k$-anonymity generalization in a single execution step. ### Why This Is Optimal This configuration fulfills all legacy format constraints, security mandates, and analytical generalization goals without requiring custom code or secondary token mapping databases.

Sensitive Data Protection Fpe Bucketing Kms | professional-cloud-data-engineer

Sensitive Data Protection Fpe Bucketing Kms

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization is designing an automated Dataflow ingestion pipeline to de-identify sensitive structured records containing Personally Identifiable Information (PII) before storing them in BigQuery for analytics. The privacy compliance team establishes the following technical constraints:

Identifier Tokenization: The 10-digit numerical patient_account_id column must retain referential integrity for analytical joins, remain reversible for authorized re-identification pipelines, and preserve its original 10-digit numeric character set to maintain backward compatibility with legacy schema validators.
Quasi-Identifier Generalization: The patient_age column must be abstracted into discrete 10-year cohorts to mitigate re-identification risk while preserving population distribution metrics.
Key Security: Plaintext cryptographic keys must not be exposed in configuration templates; all token encryption keys must be encrypted using Cloud Key Management Service (Cloud KMS).

Which transformation configuration in Cloud Sensitive Data Protection (Cloud DLP) meets all of these requirements?

Configure RecordTransformations with a cryptoDeterministicConfig specifying a kmsWrapped key for patient_account_id, and a characterMaskConfig specifying numberToMask for patient_age

Configure RecordTransformations with a cryptoReplaceFfxFpeConfig specifying a transient crypto key and numeric alphabet for patient_account_id, and a timePartConfig extracting date ranges for patient_age

Configure RecordTransformations with a cryptoReplaceFfxFpeConfig specifying a kmsWrapped key and a numeric common alphabet for patient_account_id, and a fixedSizeBucketingConfig specifying a bucket size of 10 for patient_age

Configure RecordTransformations with a cryptoHashConfig specifying a kmsWrapped key for patient_account_id, and a fixedSizeBucketingConfig specifying a bucket size of 10 for patient_age

Professional Cloud Data Engineer

Sensitive Data Protection Fpe Bucketing Kms

Related questions