professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise data platform ingests streaming customer interaction records and log files continuously into Cloud Storage, while also running batch analytical transformations in BigQuery. The security and compliance team has established the following requirements for sensitive data governance:
StudyCerts
StudyCertsACC-[0-9]{8}).Which architecture and configuration should the data engineering team implement using Sensitive Data Protection (Cloud DLP)?
Create a regex custom infoType for account identifiers and a StoredInfoType backed by a large custom dictionary for the alias list. Combine these custom detectors with built-in PII infoTypes inside a centralized InspectTemplate, reference the template in your pipelines and job triggers, and configure actions to publish findings to BigQuery.
Implement BigQuery column-level security and dynamic data masking policies on relational tables, and create custom BigQuery user-defined functions (UDFs) to inspect incoming Cloud Storage objects via external queries.
Embed inline dictionary arrays and regex objects directly inside each streaming pipeline's ad-hoc InspectConfig payload, execute synchronous inspectContent API requests per record, and output summary counters to Cloud Monitoring.
Deploy Dataplex auto data quality scans with custom SQL rules to evaluate regex expressions, and ingest Cloud IDS logs into Google Security Operations to capture and store PII classification events.
Create a regex custom infoType for account identifiers and a StoredInfoType backed by a large custom dictionary for the alias list. Combine these custom detectors with built-in PII infoTypes inside a centralized InspectTemplate, reference the template in your pipelines and job triggers, and configure actions to publish findings to BigQuery.
This architecture leverages Sensitive Data Protection (Cloud DLP) core building blocks—Custom InfoTypes, StoredInfoTypes, Inspection Templates (InspectTemplate), and Finding Actions—to deliver scalable, centralized, and automated sensitive data discovery across diverse storage systems and streaming ingestion pipelines.
EMAIL_ADDRESS and PHONE_NUMBER) are native to the inspection engine and require no custom regex maintenance.CustomInfoType with a regular expression (regex) rule cleanly captures standardized organizational patterns such as ACC-[0-9]{8}.StoredInfoType configured with a LargeCustomDictionaryConfig referencing a file set in Cloud Storage indexes large term dictionaries efficiently for high-throughput matching.InspectTemplate decouples scanning rules from pipeline code. Any update made to the inspection template instantly propagates across Cloud Storage ingestion triggers, Dataflow pipelines, and BigQuery scheduled scans.StoredInfoType pre-indexes massive term lists, reducing inspection latency.Using centralized inspection templates with stored custom infoTypes avoids hardcoded rules in pipeline code, accommodates large-scale dictionary sizes, and natively outputs detailed audit trails directly to BigQuery without custom integration overhead.
Implement BigQuery column-level security and dynamic data masking policies on relational tables, and create custom BigQuery user-defined functions (UDFs) to inspect incoming Cloud Storage objects via external queries.
Embed inline dictionary arrays and regex objects directly inside each streaming pipeline's ad-hoc InspectConfig payload, execute synchronous inspectContent API requests per record, and output summary counters to Cloud Monitoring.
Deploy Dataplex auto data quality scans with custom SQL rules to evaluate regex expressions, and ingest Cloud IDS logs into Google Security Operations to capture and store PII classification events.