A security engineer is configuring Google Cloud Sensitive Data Protection (SDP) to inspect customer support logs stored across Cloud Storage buckets and BigQuery datasets. Preliminary inspection scans produced excessive false positives for custom customer account numbers because internal system transaction IDs share the same 9-digit format. In addition, the organization needs to detect employee identifiers across text files against an authoritative corporate roster of 600,000 employee IDs without causing memory or performance bottlenecks. Which configuration should the security engineer implement in the SDP inspection template?

Define a custom regex infoType paired with hotword rules that raise match likelihood based on surrounding proximity terms, and create a stored infoType backed by BigQuery for the employee roster.: ### What Sensitive Data Protection Inspection Rules and Stored infoTypes Are **Sensitive Data Protection (SDP)** provides advanced inspection controls, including **custom infoTypes**, **hotword rules**, and **stored infoTypes** (such as large custom dictionaries). These mechanisms allow organizations to tune sensitivity detection, reduce false positives, and efficiently match structured data against massive enterprise datasets. ### How It Meets the Requirements - **Tuning likelihood and reducing false positives:** Generic 9-digit sequences can match both internal transaction IDs and customer account numbers. By configuring a **custom regex infoType** with a low baseline likelihood and adding **hotword rules** (such as looking for terms like `account`, `customer_id`, or `acct_no` within a specific token window), SDP only promotes matches to `LIKELY` or `VERY_LIKELY` when contextual tokens are present nearby. - **Large reference list scalability:** Inline dictionaries in SDP inspection templates have size limitations (up to tens of kilobytes). For an employee roster containing **600,000 records**, a **stored infoType** generated from a **BigQuery table** or Cloud Storage file builds a compact, pre-computed dictionary structure that SDP evaluates efficiently during inspection jobs without exceeding inline API payload limits or degrading scan throughput. ### Key Advantages and Capabilities - **Contextual detection accuracy:** **Hotword rules** evaluate prefix and suffix proximity windows to dynamically adjust detection confidence (`Likelihood`). - **Enterprise-scale dictionary matching:** **Stored infoTypes** allow searching against millions of phrases or identifiers by storing compiled representations in Google-managed infrastructure. - **Centralized template reusability:** Inspection templates can be shared across multiple discovery profiles, Cloud Storage inspection jobs, and BigQuery data profile scans. - **Multi-workload coverage:** Applies consistent inspection logic uniformly across object storage and analytical data warehouses. ### Why This Is Optimal Using **hotword rules** directly addresses format overlap between transaction IDs and account numbers, while leveraging **stored infoTypes** represents the architectural best practice for high-scale enterprise dictionary lookups in SDP.

Sdp Inspection Template Hotwords Stored Infotypes | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise is building an automated Dataflow pipeline to sanitize structured customer support CSV files before exporting them to BigQuery for analytics. The files contain fixed fields: Customer_ID, SSN, Age, Signup_Date, and a free-text Agent_Notes field. The security team has established the following requirements: Obfuscate SSN by masking all but the last 4 characters. Generalize Age into 10-year intervals (e.g., 20-30, 30-40) without incurring content inspection overhead. Shift Signup_Date by a randomized offset to preserve relative time intervals while protecting exact dates. Detect and replace any sensitive PII (such as email addresses and phone numbers) embedded in the unstructured Agent_Notes column with their respective infoType labels. Centrally manage and decouple transformation configurations from pipeline code using IAM controls. Which Sensitive Data Protection (SDP) configuration should the security team implement?

Configuring Sensitive Data Protection (SDP) (e.g., discovering and redacting personally identifiable information (PII), configuring pseudonymization and format preserving encryption).

AdvancedProfessional Cloud Security Engineer

An enterprise is architecting an automated data protection pipeline using Sensitive Data Protection (SDP) and Cloud Dataflow to sanitize transactional records before storing them in BigQuery. The solution must satisfy the following distinct workload requirements: Downstream Analytics Workload: Analysts need to execute SQL JOIN and aggregation operations on customer identifiers across multiple independent batch jobs and streaming runs. The tokens must be mathematically irreversible (one-way) to prevent sensitive identity leakage under any circumstance. Regulatory Compliance Workload: Compliance officers must be able to reverse the pseudonyms (two-way tokenization) back to cleartext during authorized audits. Downstream systems for this workload do not have legacy schema or field-length constraints, so the strongest cryptographic authentication guarantees must be used. Key Security Policy: Plaintext keys must never be exposed over API calls or templates, and tokenization integrity must persist consistently across multiple API requests and pipeline runs. Which combination of Sensitive Data Protection cryptographic transformations and key configurations should the security engineer implement?

AdvancedProfessional Cloud Security Engineer

An enterprise is deploying automated AI agents built on the Gemini Enterprise Agent Platform. The security operations team needs to establish continuous auditing and threat detection to identify suspicious behavior by agent service account identities. Specifically, the security team must detect: An AI agent attempting reconnaissance by investigating the IAM roles and permissions assigned to its own service account identity. An AI agent making unauthorized cross-project API calls to discover or interact with external resources. Which solution should the security engineer implement to satisfy these requirements?

AdvancedProfessional Cloud Security Engineer

A security engineer must configure temporary, schedule-restricted access for a third-party security auditor in a specific Google Cloud project. The access policy must satisfy the following criteria: The auditor must be granted the Security Reviewer role (roles/iam.securityReviewer). Access must be restricted to standard working hours: Monday through Friday (Day 1 through Day 5), between 09:00 and 17:00 in the Europe/Berlin time zone. All access must automatically expire at midnight UTC on December 31, 2025 (2025-12-31T23:59:59Z). The policy must be applied programmatically using the Resource Manager API and Google Cloud CLI. Which Common Expression Language (CEL) IAM condition and policy structure should the security engineer implement?

AdvancedProfessional Cloud Security Engineer

An enterprise is establishing a multi-tier Google Cloud resource hierarchy to support several business units with strict regulatory requirements across Development, Staging, and Production environments. The security architecture must satisfy the following constraints: Enforce distinct environment-specific organization policies (such as location restrictions and external IP constraints) and prevent accidental inheritance of permissive non-production settings into production. Implement strict separation of duties between central network administrators, security operators, and application development teams. Centralize and automate project provisioning and billing linkage to prevent shadow IT and unmanaged cost sprawl. Provide private network isolation between environments while allowing developers to provision compute workloads using pre-allocated enterprise IP subnets. Which resource hierarchy and access governance architecture should the organization deploy?

AdvancedProfessional Cloud Data Engineer

An enterprise is designing a secure data ingestion and analytics pipeline on Google Cloud that must adhere to strict regulatory compliance and data sovereignty constraints: Ingestion Staging (Cloud Storage): Compliance mandates that raw file uploads use encryption where cryptographic key material is held exclusively by the customer, supplied in-memory on each API request, and never stored persistently anywhere on Google Cloud servers. Analytics Warehouse (BigQuery): The data warehouse must use dedicated symmetric keys managed within Google Cloud with customer control over rotation schedules, audit logging of key access, and the capability to perform crypto-shredding on demand. Data Sovereignty Constraint (Regulatory HYOK): Master key material for specific regulatory analytics tables must physically reside within an external on-premises key manager outside of Google Cloud, while still integrating with Google Cloud services for server-side decryption. Which combination of encryption mechanisms should the enterprise implement?

Professional Cloud Security Engineer

Sdp Inspection Template Hotwords Stored Infotypes

Related questions