An enterprise is designing an automated data ingestion pipeline to process transaction records before storing them in BigQuery for analytics. The incoming records include sensitive commercial and personally identifiable information (PII) with the following specific requirements: Credit card numbers: Must be pseudonymized so that legacy processing systems expecting a 16-digit numeric string can still parse the data without schema errors, while allowing authorized security teams to reverse the tokenization back to the original number. Customer age: Must be generalized into discrete numerical ranges to reduce re-identification risk while preserving utility for demographic reporting. Customer support notes: Contain unstructured free-form text that must be automatically scanned for unforeseen sensitive data (such as email addresses and phone numbers) and obfuscated. Which combination of Sensitive Data Protection (Cloud DLP) de-identification transformations should the cloud architect specify in the de-identification template?

Use Format-Preserving Encryption (FPE-FFX) for credit card numbers, fixed-size bucketing for customer age, and an infoType inspection transformation with character masking for support notes.: What This Solution Is Sensitive Data Protection (formerly Cloud DLP) provides configurable de-identification transformations that allow organizations to obfuscate, tokenize, mask, or generalize sensitive data at scale across streaming and batch pipelines. How It Meets the Requirements Credit Card Numbers (Reversible and Schema Compatible): Format-Preserving Encryption (FPE) in FFX mode encrypts data while preserving both the original string length (e.g., 16 digits) and the character set (numeric characters). Because it is a two-way cryptographic tokenization method, authorized administrators using the corresponding wrapped token encryption key in Cloud KMS can reverse the ciphertext to restore the original credit card number. Customer Age (Generalization): Fixed-size bucketing is a primitive transformation that groups individual continuous values into discrete categorical ranges (such as ages 20–29, 30–39), mitigating quasi-identifier disclosure risk while maintaining demographic aggregate value. Unstructured Support Notes (Automated Discovery & Masking): For free-form text fields where sensitive infoTypes are not isolated to designated columns, an infoTypeTransformations configuration inspects the text using built-in detectors (such as EMAIL_ADDRESS and PHONE_NUMBER) and applies character masking to replace matching tokens with characters like # or *. Key Advantages and Capabilities Backward Compatibility: Allows downstream legacy systems to process tokenized credit card fields without modifying strict schema definitions or character-length limits. Two-Way Cryptographic Integrity: Preserves referential integrity across datasets for join operations while enabling full re-identification when legally required. Fine-Grained Contextual Detection: Scans unstructured text payloads with over 100+ pre-built classifiers to eliminate unintended leakage in notes or comments. Centralized Policy Management: Encapsulates transformation rules into reusable Sensitive Data Protection templates, decoupling security logic from data pipelines. Why This Is Optimal This architecture accurately satisfies all operational and structural constraints. It avoids breaking downstream schema constraints on legacy applications while maintaining strong de-identification and risk-mitigation standards across structured and unstructured data formats.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Sensitive Data Protection Dlp Deidentification Transformations

Section: Commercial (e.g., sensitive data such as credit card information handling and personally identifiable information [PII])

An enterprise is designing an automated data ingestion pipeline to process transaction records before storing them in BigQuery for analytics. The incoming records include sensitive commercial and personally identifiable information (PII) with the following specific requirements:

Credit card numbers: Must be pseudonymized so that legacy processing systems expecting a 16-digit numeric string can still parse the data without schema errors, while allowing authorized security teams to reverse the tokenization back to the original number.
Customer age: Must be generalized into discrete numerical ranges to reduce re-identification risk while preserving utility for demographic reporting.
Customer support notes: Contain unstructured free-form text that must be automatically scanned for unforeseen sensitive data (such as email addresses and phone numbers) and obfuscated.

Which combination of Sensitive Data Protection (Cloud DLP) de-identification transformations should the cloud architect specify in the de-identification template?

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Sensitive Data Protection Dlp Deidentification Transformations

Section: Commercial (e.g., sensitive data such as credit card information handling and personally identifiable information [PII])

Credit card numbers: Must be pseudonymized so that legacy processing systems expecting a 16-digit numeric string can still parse the data without schema errors, while allowing authorized security teams to reverse the tokenization back to the original number.
Customer age: Must be generalized into discrete numerical ranges to reduce re-identification risk while preserving utility for demographic reporting.
Customer support notes: Contain unstructured free-form text that must be automatically scanned for unforeseen sensitive data (such as email addresses and phone numbers) and obfuscated.

Which combination of Sensitive Data Protection (Cloud DLP) de-identification transformations should the cloud architect specify in the de-identification template?

Explanations

What This Solution Is

Sensitive Data Protection (formerly Cloud DLP) provides configurable de-identification transformations that allow organizations to obfuscate, tokenize, mask, or generalize sensitive data at scale across streaming and batch pipelines.

How It Meets the Requirements

Credit Card Numbers (Reversible and Schema Compatible): Format-Preserving Encryption (FPE) in FFX mode encrypts data while preserving both the original string length (e.g., 16 digits) and the character set (numeric characters). Because it is a two-way cryptographic tokenization method, authorized administrators using the corresponding wrapped token encryption key in Cloud KMS can reverse the ciphertext to restore the original credit card number.
Customer Age (Generalization): Fixed-size bucketing is a primitive transformation that groups individual continuous values into discrete categorical ranges (such as ages 20–29, 30–39), mitigating quasi-identifier disclosure risk while maintaining demographic aggregate value.
Unstructured Support Notes (Automated Discovery & Masking): For free-form text fields where sensitive infoTypes are not isolated to designated columns, an infoTypeTransformations configuration inspects the text using built-in detectors (such as EMAIL_ADDRESS and PHONE_NUMBER) and applies character masking to replace matching tokens with characters like # or *.

Key Advantages and Capabilities

Backward Compatibility: Allows downstream legacy systems to process tokenized credit card fields without modifying strict schema definitions or character-length limits.
Two-Way Cryptographic Integrity: Preserves referential integrity across datasets for join operations while enabling full re-identification when legally required.
Fine-Grained Contextual Detection: Scans unstructured text payloads with over 100+ pre-built classifiers to eliminate unintended leakage in notes or comments.
Centralized Policy Management: Encapsulates transformation rules into reusable Sensitive Data Protection templates, decoupling security logic from data pipelines.

Why This Is Optimal

This architecture accurately satisfies all operational and structural constraints. It avoids breaking downstream schema constraints on legacy applications while maintaining strong de-identification and risk-mitigation standards across structured and unstructured data formats.

View source documentation

Professional Cloud Architect

Sensitive Data Protection Dlp Deidentification Transformations

Professional Cloud Architect

Sensitive Data Protection Dlp Deidentification Transformations

What This Solution Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions