An enterprise is architecting an automated data protection pipeline using Sensitive Data Protection (SDP) and Cloud Dataflow to sanitize transactional records before storing them in BigQuery. The solution must satisfy the following distinct workload requirements: Downstream Analytics Workload: Analysts need to execute SQL JOIN and aggregation operations on customer identifiers across multiple independent batch jobs and streaming runs. The tokens must be mathematically irreversible (one-way) to prevent sensitive identity leakage under any circumstance. Regulatory Compliance Workload: Compliance officers must be able to reverse the pseudonyms (two-way tokenization) back to cleartext during authorized audits. Downstream systems for this workload do not have legacy schema or field-length constraints, so the strongest cryptographic authentication guarantees must be used. Key Security Policy: Plaintext keys must never be exposed over API calls or templates, and tokenization integrity must persist consistently across multiple API requests and pipeline runs. Which combination of Sensitive Data Protection cryptographic transformations and key configurations should the security engineer implement?

Configure Cryptographic Hashing with a Cloud KMS-wrapped key for Analytics, and Deterministic Encryption (AES-SIV) with a Cloud KMS-wrapped key for Regulatory Compliance.: ### What the Solution Is Sensitive Data Protection provides cryptographic de-identification primitives designed to balance data privacy, referential integrity, and analytical utility. This solution combines **one-way cryptographic hashing** (`CryptoHashConfig`) for irreversible tokenization with **deterministic encryption** (`CryptoDeterministicConfig` using AES-SIV) for reversible pseudonymization, both backed by **Cloud KMS-wrapped cryptographic keys** (`KmsWrappedCryptoKey`). ### How It Meets the Requirements * **Referential Integrity for Analytics**: Cryptographic hashing utilizes **HMAC-SHA-256** with a secret key to produce a deterministic, uniform base64-encoded digest. Because the same input identifier always maps to the same hash output across multiple Dataflow pipeline runs, analysts can perform deterministic `JOIN` and `GROUP BY` operations without ever being able to decrypt or re-identify the raw identifier. * **Reversible Pseudonymization with Strong Cryptography**: Deterministic encryption using **AES-SIV (Synthetic Initialization Vector)** provides authenticated, reversible pseudonymization. When legacy schema format preservation is not required, AES-SIV is the recommended method because it offers stronger cryptographic guarantees (including built-in message authentication) than Format-Preserving Encryption (FPE-FFX). * **Production Key Management & Multi-Request Integrity**: By encrypting the primary 128-, 192-, or 256-bit token encryption keys with a Key Encryption Key (KEK) stored in **Cloud Key Management Service (Cloud KMS)**, raw keys are never transmitted or stored in plaintext. Cloud KMS-wrapped keys persist across independent API calls, ensuring referential integrity across disparate batch and streaming jobs. ### Key Advantages and Capabilities * **Strict Access Control**: Cloud KMS IAM policies restrict key decryption permissions, allowing separate access governance between analytics teams and compliance officers. * **Irreversible One-Way Processing**: HMAC-SHA-256 hashing permanently protects customer identifiers from algorithmic decryption even if query permissions are broad. * **Authenticated Deterministic Security**: AES-SIV guarantees ciphertext integrity and deterministic matching without requiring format constraints. * **Multi-Job Consistency**: Eliminates key drift across distributed Dataflow workers. ### Why This Is Optimal This architecture strictly enforces least-privilege token reversibility by utilizing irreversible hashing for standard analytics and authenticated AES-SIV deterministic encryption only for workflows that explicitly require re-identification. Utilizing Cloud KMS wrapping meets enterprise key management standards without exposing plaintext secrets in de-identification templates.

Sdp Cryptographic Transformations Fpe De Hashing | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise is building an automated Dataflow pipeline to sanitize structured customer support CSV files before exporting them to BigQuery for analytics. The files contain fixed fields: Customer_ID, SSN, Age, Signup_Date, and a free-text Agent_Notes field. The security team has established the following requirements: Obfuscate SSN by masking all but the last 4 characters. Generalize Age into 10-year intervals (e.g., 20-30, 30-40) without incurring content inspection overhead. Shift Signup_Date by a randomized offset to preserve relative time intervals while protecting exact dates. Detect and replace any sensitive PII (such as email addresses and phone numbers) embedded in the unstructured Agent_Notes column with their respective infoType labels. Centrally manage and decouple transformation configurations from pipeline code using IAM controls. Which Sensitive Data Protection (SDP) configuration should the security team implement?

Configuring Sensitive Data Protection (SDP) (e.g., discovering and redacting personally identifiable information (PII), configuring pseudonymization and format preserving encryption).

AdvancedProfessional Cloud Security Engineer

A security engineer is configuring Google Cloud Sensitive Data Protection (SDP) to inspect customer support logs stored across Cloud Storage buckets and BigQuery datasets. Preliminary inspection scans produced excessive false positives for custom customer account numbers because internal system transaction IDs share the same 9-digit format. In addition, the organization needs to detect employee identifiers across text files against an authoritative corporate roster of 600,000 employee IDs without causing memory or performance bottlenecks. Which configuration should the security engineer implement in the SDP inspection template?

AdvancedProfessional Cloud Security Engineer

An organization is designing an automated identity synchronization architecture between their on-premises Active Directory Domain Services (AD DS) forest and Cloud Identity to enable workforce access to Google Cloud resources. The security team establishes the following requirements: User lifecycle management (creation, updates, suspensions) must be automated from AD DS to Cloud Identity without synchronizing user password hashes to Google Cloud. If the on-premises identity federation service experiences an outage or misconfiguration, administrators must still be able to re-authorize and manage the directory synchronization tool. The directory synchronization service account in Cloud Identity must follow isolation best practices and be protected against authentication lockouts. Which architectural and configuration approach should the organization implement?

AdvancedProfessional Cloud Security Engineer

An enterprise has deployed Cloud Next-Generation Firewall (Cloud NGFW) Enterprise with Intrusion Prevention Service (IPS) profiles and TLS inspection to secure sensitive workloads within a VPC network. The Security Operations Center (SOC) is investigating suspicious outbound Layer 7 application traffic suspected of being command-and-control (C2) communication. The security team must: Verify whether Cloud NGFW detected the threat signature and whether the policy actively blocked or merely alerted on the traffic. Identify the Layer 7 application name, threat ID, and threat severity directly from the log records. Stream high-severity threat events in real time to the enterprise SIEM for automated incident triage without losing critical security signals. Which logging analysis and integration strategy should the security engineer implement?

AdvancedProfessional Cloud Security Engineer

An enterprise organization is designing an automated pipeline to route audit logs from multiple production projects to a centralized Cloud Storage bucket in a dedicated security project. The exported logs must be encrypted at rest using Customer-Managed Encryption Keys (CMEK) and protected against data exfiltration using VPC Service Controls. Which set of actions should the security engineer take to implement this pipeline following the principle of least privilege?

AdvancedProfessional Cloud Data Engineer

A data platform team operates large-scale ELT pipelines and BigQuery analytics workloads across multiple Google Cloud projects. The team needs to establish a proactive cost governance and monitoring strategy to satisfy the following requirements: Analyze and visualize granular, resource-level historical infrastructure spend against planned budgets in Looker Studio. Ensure downstream dashboards and reporting queries remain resilient to schema updates and added fields in the underlying billing export tables. Receive proactive notifications whenever projected monthly spend is trending to exceed defined budget thresholds before the billing cycle completes. Which architecture and configuration should the team implement?

Professional Cloud Security Engineer

Sdp Cryptographic Transformations Fpe De Hashing

Related questions