Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise is preparing customer service datasets stored in Google Cloud to train a machine learning model for sentiment analysis. The datasets include structured customer identifier fields (such as customer email addresses) alongside unstructured freeform text fields (such as customer support notes and reviews).
The machine learning engineering team has specified the following requirements:
Which Sensitive Data Protection (SDP) architecture should you implement?
Enable Sensitive Data Protection automated discovery to generate data profiles and export the resulting data risk metrics to Security Command Center and Dataplex.
Configure a Sensitive Data Protection inspection job with record suppression rules configured to drop any record that contains a customer email address or detected sensitive infoTypes.
Apply BigQuery policy tags with column-level security and IAM access controls to restrict access to the customer email column and freeform text review columns.
Configure a Sensitive Data Protection de-identification template that performs cryptographic tokenization on the structured email identifier field and applies masking transformations on detected sensitive infoTypes within the freeform text fields.
Enable Sensitive Data Protection automated discovery to generate data profiles and export the resulting data risk metrics to Security Command Center and Dataplex.
Configure a Sensitive Data Protection inspection job with record suppression rules configured to drop any record that contains a customer email address or detected sensitive infoTypes.
Apply BigQuery policy tags with column-level security and IAM access controls to restrict access to the customer email column and freeform text review columns.
Configure a Sensitive Data Protection de-identification template that performs cryptographic tokenization on the structured email identifier field and applies masking transformations on detected sensitive infoTypes within the freeform text fields.
Sensitive Data Protection (SDP) provides automated de-identification and transformation capabilities designed to sanitize structured and unstructured data before it is ingested by downstream workloads such as AI/ML model training pipelines. Using custom de-identification templates, SDP can apply field-level cryptographic pseudonymization (tokenization) as well as content-level inspection and masking on unstructured text.
StudyCerts
StudyCertsemail field replaces sensitive identifiers with consistent surrogate tokens. Because identical inputs generate identical surrogate tokens when using the same crypto key, the ML team can group, join, and aggregate records belonging to the same user without seeing the underlying email address.PHONE_NUMBER and US_SOCIAL_SECURITY_NUMBER) and applies masking transformations (e.g., replacing values with *** or surrogate tags) directly to detected sensitive text.This solution strikes the optimal balance between data privacy and data utility. Pure redaction or record deletion would destroy the relational links required for customer-level sentiment modeling, whereas tokenization preserves structural analytical value while eliminating cleartext PII risk.