An enterprise is building an automated Dataflow pipeline to sanitize structured customer support CSV files before exporting them to BigQuery for analytics. The files contain fixed fields: Customer_ID, SSN, Age, Signup_Date, and a free-text Agent_Notes field. The security team has established the following requirements: Obfuscate SSN by masking all but the last 4 characters. Generalize Age into 10-year intervals (e.g., 20-30, 30-40) without incurring content inspection overhead. Shift Signup_Date by a randomized offset to preserve relative time intervals while protecting exact dates. Detect and replace any sensitive PII (such as email addresses and phone numbers) embedded in the unstructured Agent_Notes column with their respective infoType labels. Centrally manage and decouple transformation configurations from pipeline code using IAM controls. Which Sensitive Data Protection (SDP) configuration should the security team implement?

Create a structured SDP DeidentifyTemplate that defines recordTransformations. Use primitiveTransformation rules with characterMaskConfig for SSN, fixedSizeBucketingConfig for Age, and dateShiftConfig for Signup_Date applied directly to field names. Apply infoTypeTransformations with replaceWithInfoTypeConfig only to the Agent_Notes field, and pass the template ID to the Dataflow pipeline.: ### What the structured SDP de-identification template is A structured **Sensitive Data Protection (SDP)** `DeidentifyTemplate` provides a centralized, reusable, and IAM-governed configuration resource that uses `recordTransformations` to transform structured tabular datasets (such as CSV files or database tables) at the column or field level. ### How it meets all requirements - **Masking SSN**: Direct field transformation using `characterMaskConfig` applies a non-cryptographic character mask to the `SSN` column, masking all but the specified number of trailing characters without requiring an inspection pass. - **Bucketing Age**: Direct field transformation using `fixedSizeBucketingConfig` places integer values into predefined discrete ranges (e.g., `bucketSize: 10`) without content inspection, reducing uniqueness and minimizing API processing overhead. - **Date Shifting**: Direct field transformation using `dateShiftConfig` shifts dates within a defined lower- and upper-bound range per individual or context, preserving relative time spacing for analytics while obscuring the true date. - **Sanitizing Free-Text Notes**: Applying `infoTypeTransformations` (with `replaceWithInfoTypeConfig`) specifically to the `Agent_Notes` field enables dynamic pattern recognition and replacement of detected PII (such as `EMAIL_ADDRESS` and `PHONE_NUMBER`) with token labels. - **Centralized Pipeline Integration**: Managing rules inside an SDP template decouples transformation definitions from the **Cloud Dataflow** pipeline code, enabling centralized security management and IAM access delegation. ### Key advantages and capabilities - **Cost and resource optimization**: Performing direct field transformations on known tabular schema columns bypasses the expensive `inspectConfig` evaluation stage. - **Targeted inspection**: Restricts deeper heuristic scanning exclusively to unstructured text columns (`Agent_Notes`). - **Decoupled governance**: Allows security administrators to adjust transformation logic and IAM permissions without rebuilding or redeploying ETL pipelines. ### Why this is optimal This approach aligns with Google Cloud architectural best practices by isolating resource-heavy infoType inspections to unknown/unstructured fields while executing deterministic, non-cryptographic transformations directly against known structured columns via reusable templates.

Sdp Non Cryptographic De Identification Pipeline | Professional Cloud Security Engineer

Sdp Non Cryptographic De Identification Pipeline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is building an automated Dataflow pipeline to sanitize structured customer support CSV files before exporting them to BigQuery for analytics. The files contain fixed fields: Customer_ID, SSN, Age, Signup_Date, and a free-text Agent_Notes field.

The security team has established the following requirements:

Obfuscate SSN by masking all but the last 4 characters.
Generalize Age into 10-year intervals (e.g., 20-30, 30-40) without incurring content inspection overhead.
Shift Signup_Date by a randomized offset to preserve relative time intervals while protecting exact dates.
Detect and replace any sensitive PII (such as email addresses and phone numbers) embedded in the unstructured Agent_Notes column with their respective infoType labels.
Centrally manage and decouple transformation configurations from pipeline code using IAM controls.

Which Sensitive Data Protection (SDP) configuration should the security team implement?

Configure an unstructured SDP DeidentifyTemplate that utilizes ImageTransformations with redactionColor and ReplaceWithInfoTypeConfig, and embed the raw JSON configuration directly within the Dataflow pipeline worker code.

Configure a BigQuery SQL query pipeline using remote functions hosted on Cloud Run that invokes the DLP API using deterministic encryption (DE) and format-preserving encryption (FFX) for all fields before writing to destination tables.

Create a structured SDP DeidentifyTemplate that defines recordTransformations. Use primitiveTransformation rules with characterMaskConfig for SSN, fixedSizeBucketingConfig for Age, and dateShiftConfig for Signup_Date applied directly to field names. Apply infoTypeTransformations with replaceWithInfoTypeConfig only to the Agent_Notes field, and pass the template ID to the Dataflow pipeline.

Create an SDP InspectTemplate configured with built-in infoTypes for US_SOCIAL_SECURITY_NUMBER, AGE, DATE, and EMAIL_ADDRESS. Apply global infoTypeTransformations with characterMaskConfig, fixedSizeBucketingConfig, and dateShiftConfig across all columns in the Dataflow pipeline.

Professional Cloud Security Engineer

Sdp Non Cryptographic De Identification Pipeline

Related questions