A financial enterprise is designing an application-layer data protection pipeline to process customer transaction records before storing them in a shared data repository. The security team established the following technical requirements: Sensitive 10-digit customer account numbers and telephone numbers must be encrypted using Format-Preserving Encryption (FPE) in FFX mode to maintain exact numeric lengths and data types for downstream database compatibility. The transformation must support two-way reversibility (re-identification) by authorized security auditing services. The underlying symmetric data encryption key (DEK) used by the encryption engine must be protected using envelope encryption and wrapped by a Cloud Key Management Service (Cloud KMS) Key Encryption Key (KEK), preventing plaintext DEK exposure in application configurations. Transformed values must include surrogate metadata tags so automated re-identification jobs can identify and reverse the specific field transformation. Which Sensitive Data Protection (Cloud DLP) configuration meets these requirements?

Define a primitive transformation using CryptoReplaceFfxFpeConfig with a KmsWrappedCryptoKey containing the base64-encoded wrapped DEK and Cloud KMS key resource name, set the alphabet to NUMERIC, and specify a SurrogateInfoType.: ### What Sensitive Data Protection FPE with KMS Wrapped Keys is **Sensitive Data Protection** (Cloud DLP) provides cryptographic de-identification transformations such as **Format-Preserving Encryption (FPE)** via `CryptoReplaceFfxFpeConfig`. FPE encrypts structured input data (such as numeric telephone numbers or account numbers) into ciphertext of the exact same length and character set using the **FFX mode of operation** (specifically AES-256 in FFX). ### How it meets the requirements - **Format-Preserving Encryption and Numeric Compatibility**: By configuring `CryptoReplaceFfxFpeConfig` and choosing `CommonAlphabet.NUMERIC`, the generated ciphertext preserves character length and the numeric character domain, preventing database schema mismatches. - **Reversibility (Re-identification)**: FPE is a two-way cryptographic scheme. Sensitive Data Protection allows re-identification requests (`ReidentifyContent`) using the same cryptographic key and parameters. - **Envelope Encryption with Cloud KMS**: Instead of supplying an unencrypted `UnwrappedCryptoKey`, the API supports `KmsWrappedCryptoKey`. The client provides the base64-encoded encrypted data encryption key (`WrappedKey`) along with the Cloud KMS resource identifier (`CryptoKeyName`). Sensitive Data Protection uses Cloud KMS IAM permissions to decrypt the DEK in memory inside Google's secure perimeter. - **Surrogate Annotations**: Defining a `SurrogateInfoType` wraps or tags the transformed output with a custom infoType token (for example, `ACCOUNT_TOKEN(...)`), enabling downstream inspection rules to detect surrogate tokens and route them to re-identification pipelines. ### Key advantages - **Database Integrity**: Preserves original data formats, schemas, and referential constraints without truncation. - **Strong Key Governance**: Leverages Cloud KMS IAM, auditing, and key rotation mechanisms to wrap DEKs. - **Zero Plaintext DEK Storage**: Applications do not need to persist or expose raw AES keys in local environments. - **Automated Re-identification**: Native support for surrogate infoTypes simplifies workflow automation. ### Why this is optimal This approach combines NIST-standardized format-preserving encryption with automated envelope encryption, ensuring strong cryptographic security and compliance without disrupting relational database schemas.

Sensitive Data Protection Fpe Kms Wrapped Surrogate | Professional Cloud Security Engineer

Sensitive Data Protection Fpe Kms Wrapped Surrogate

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is designing an application-layer data protection pipeline to process customer transaction records before storing them in a shared data repository. The security team established the following technical requirements:

Sensitive 10-digit customer account numbers and telephone numbers must be encrypted using Format-Preserving Encryption (FPE) in FFX mode to maintain exact numeric lengths and data types for downstream database compatibility.
The transformation must support two-way reversibility (re-identification) by authorized security auditing services.
The underlying symmetric data encryption key (DEK) used by the encryption engine must be protected using envelope encryption and wrapped by a Cloud Key Management Service (Cloud KMS) Key Encryption Key (KEK), preventing plaintext DEK exposure in application configurations.
Transformed values must include surrogate metadata tags so automated re-identification jobs can identify and reverse the specific field transformation.

Which Sensitive Data Protection (Cloud DLP) configuration meets these requirements?

Define a primitive transformation using CryptoHashConfig with a TransientCryptoKey, and apply a CustomInfoType dictionary rule.

Define a DateShiftConfig transformation specifying upper and lower bounds, configure a contextField for consistent shifting, and provide a KmsWrappedCryptoKey.

Define a primitive transformation using CryptoReplaceFfxFpeConfig with an UnwrappedCryptoKey embedded in the API payload, set the alphabet to NUMERIC, and omit the SurrogateInfoType.

Define a primitive transformation using CryptoReplaceFfxFpeConfig with a KmsWrappedCryptoKey containing the base64-encoded wrapped DEK and Cloud KMS key resource name, set the alphabet to NUMERIC, and specify a SurrogateInfoType.

Professional Cloud Security Engineer

Sensitive Data Protection Fpe Kms Wrapped Surrogate

Related questions