An enterprise is architecting an end-to-end data governance and security pipeline for an AI/ML workload on Google Cloud. The architecture must satisfy three strict privacy and compliance requirements: Training Data Sanitization: Unstructured text data stored in Cloud Storage containing personally identifiable information (PII) must be discovered, classified, and tokenized or masked before model training. Feature Engineering Privacy: Aggregated analytics and feature extraction in BigQuery must prevent the re-identification of individual records by adding mathematical noise to statistical queries. Data-in-Use Protection: Sensitive data and model weights must remain encrypted while actively loaded in memory during Vertex AI custom model training and prediction execution. Which combination of Google Cloud security controls and architectural services meets all of these requirements?

De-identify unstructured text using a Dataflow pipeline with Sensitive Data Protection (Cloud DLP) templates; apply BigQuery differential privacy aggregations during feature extraction; configure Vertex AI custom training jobs on compute instances with Confidential Computing enabled.: ### What the Unified Solution Is This architecture leverages **Sensitive Data Protection (Cloud DLP)**, **BigQuery differential privacy**, and **Vertex AI Confidential Computing** to enforce end-to-end data governance, mathematical privacy guarantees, and hardware-level memory isolation across the entire machine learning lifecycle. ### How It Meets the Requirements * **Training Data Sanitization**: A **Dataflow streaming or batch pipeline** calling **Sensitive Data Protection** uses built-in **infoTypes** (such as names, email addresses, and phone numbers) to automatically inspect unstructured text. It applies cryptographic transformations like deterministic tokenization or masking before passing clean data to the training pool. * **Feature Engineering Privacy**: BigQuery natively supports **differential privacy aggregations**. When computing features across datasets, BigQuery injects calibrated mathematical noise and establishes an epsilon privacy budget, preventing data scientists or queries from reverse-engineering individual contributor records. * **Data-in-Use Protection**: By running custom training and prediction workloads on **Confidential VMs** in **Vertex AI**, memory contents (including raw features, gradients, and model weights) are encrypted in RAM using dedicated hardware keys inside a **Trusted Execution Environment (TEE)**, protecting data while actively in use against host-level inspection. ### Key Advantages and Capabilities * **Defense-in-Depth**: Secures data across all three states: at rest (Cloud Storage/BigQuery), in transit (Dataflow pipelines), and in use (Confidential Computing RAM encryption). * **Preserved Analytics Utility**: Tokenization and differential privacy allow models to learn statistical correlations without learning sensitive individual attributes. * **Scalable Automation**: Integrates natively into automated MLOps pipelines orchestrated with Vertex AI Pipelines. ### Why This Is Optimal This combination aligns directly with standard AI governance and security frameworks by combining content-aware inspection, mathematical privacy bounds, and hardware-enforced trusted execution environments.

Ai Data Governance Privacy Controls | Professional Cloud Security Engineer

Ai Data Governance Privacy Controls

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is architecting an end-to-end data governance and security pipeline for an AI/ML workload on Google Cloud. The architecture must satisfy three strict privacy and compliance requirements:

Training Data Sanitization: Unstructured text data stored in Cloud Storage containing personally identifiable information (PII) must be discovered, classified, and tokenized or masked before model training.
Feature Engineering Privacy: Aggregated analytics and feature extraction in BigQuery must prevent the re-identification of individual records by adding mathematical noise to statistical queries.
Data-in-Use Protection: Sensitive data and model weights must remain encrypted while actively loaded in memory during Vertex AI custom model training and prediction execution.

Which combination of Google Cloud security controls and architectural services meets all of these requirements?

Deploy VPC Service Controls perimeters around Cloud Storage to filter outbound PII; enforce BigQuery row-level security (RLS) policies for feature engineering; apply Binary Authorization image signing on Vertex AI containers.

Configure BigQuery dynamic data masking using policy tags on dataset schemas; utilize k-means clustering in BigQuery ML for feature anonymization; attach Customer-Managed Encryption Keys (CMEK) to Vertex AI Workbench persistent disks.

De-identify unstructured text using a Dataflow pipeline with Sensitive Data Protection (Cloud DLP) templates; apply BigQuery differential privacy aggregations during feature extraction; configure Vertex AI custom training jobs on compute instances with Confidential Computing enabled.

Use Dataplex auto-data quality scans to drop rows with sensitive metadata; execute standard SQL SHA256 hashing functions in BigQuery for feature engineering; configure Shielded VM Secure Boot on Vertex AI custom jobs.

Professional Cloud Security Engineer

Ai Data Governance Privacy Controls

Related questions