Dlp Inspect Template Environment Isolation Iac

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise manages three separate Google Cloud environments (development, staging, and production) deployed across distinct GCP projects. The security team requires uniform Sensitive Data Protection (Cloud DLP) inspection rules—such as scanning for national identifiers, credentials, and sensitive customer data—across storage repositories in all environments. Currently, individual teams define inline inspection configurations inside their local continuous integration and continuous deployment (CI/CD) pipelines, which has caused severe configuration drift and high operational maintenance.

You need to implement a declarative Infrastructure as Code (IaC) configuration architecture that enforces standardized inspection policies across all environments, isolates deployment states, and allows policy updates without modifying downstream jobs. What should you do?

Deploy project-level InspectTemplate resources across all projects using a single monolithic Terraform state file shared across development, staging, and production.

Define inline InspectConfig payloads inside each environment's Terraform state file and repository, requiring each team to independently update their configurations.

Create a unified DeidentifyTemplate at the organization level, and configure each environment's pipeline to apply de-identification transformations directly during storage scans.

Declare centralized InspectTemplate resources at the organization level with dedicated state isolation, and configure environment-specific scan jobs to reference the organization template ID.

Professional Cloud DevOps Engineer

Dlp Inspect Template Environment Isolation Iac

Related questions