Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Dlp Classify Phi Pii Custom Infotypes Rulesets

Section: Handling sensitive data (e.g., using log processors to redact personally identifiable information [PII], protected health information [PHI])

An organization is streaming application logs from a clinical healthcare microservice into Google Cloud. During a security audit, you identify that unstructured log messages contain both direct identifiers—specifically proprietary Medical Record Numbers (MRNs) following the pattern ###-#-#####—and potential quasi-identifiers such as person names that could expose Protected Health Information (PHI).

You need to design a Sensitive Data Protection (Cloud DLP) inspection strategy that accurately identifies and classifies these distinct data categories while minimizing false positives from standard application terms.

Which inspection configuration should you implement?

Deploy a BigQuery ML logistic regression classification model directly onto the log router stream to categorize log lines into binary categories of sensitive and non-sensitive.

Implement an exclusion rule that suppresses all PERSON_NAME findings unless matched by a regular custom dictionary, and assign a fixed likelihood of VERY_LIKELY to every numeric sequence matching ###-#-#####.

Configure a stored custom dictionary detector containing static regular expressions for MRNs, and configure default global inspection rules to lower the likelihood of all PERSON_NAME findings across all service log streams.

Create a custom regular expression (regex) infoType detector for the MRN pattern, apply the built-in PERSON_NAME detector augmented with hotword rules that increase likelihood when clinical context words appear, and add exclusion rules to filter out standard system tokens.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Dlp Classify Phi Pii Custom Infotypes Rulesets

Section: Handling sensitive data (e.g., using log processors to redact personally identifiable information [PII], protected health information [PHI])

Which inspection configuration should you implement?

Deploy a BigQuery ML logistic regression classification model directly onto the log router stream to categorize log lines into binary categories of sensitive and non-sensitive.

Explanations

What Custom Detectors and Inspection Rules Are

Sensitive Data Protection (Cloud DLP) provides inspection mechanisms to locate, classify, and de-identify sensitive data in text streams. While Google Cloud supplies built-in infoTypes (such as PERSON_NAME), organizations often require specialized detection for proprietary formats—such as custom Medical Record Numbers (MRNs)—and nuanced context-aware detection rules to distinguish sensitive quasi-identifiers from general text.

How It Meets the Requirements

Detecting Direct Identifiers (MRN): By creating a custom regular expression detector matching [1-9]{3}-[1-9]{1}-[1-9]{5}, Sensitive Data Protection can identify organizational MRNs that do not conform to standardized national identifiers.
Refining Quasi-Identifiers (PHI/PII): Pairing the built-in PERSON_NAME detector with hotword rules allows the engine to evaluate proximity words such as patient or doctor. Finding these hotwords within a defined search window shifts the match likelihood (e.g., from POSSIBLE to VERY_LIKELY), differentiating true PHI from generic names.
Minimizing False Positives: Adding exclusion rules (such as dictionary or regex filters for known system strings like REDACTED or placeholder identifiers) prevents benign application tokens from generating erroneous findings.

Key Advantages and Capabilities

Contextual Accuracy: Hotword rules dynamically adjust match certainty based on surrounding contextual terms.
Granular Classification: Distinguishes custom domain-specific direct identifiers from generalized PII/PHI categories.
Noise Reduction: Exclusion rules suppress unwanted matches, saving log processing compute and alert fatigue.
Native Integration: Works directly within Cloud DLP inspection configurations (InspectConfig and InspectionRuleSet).

Why This Is Optimal

This approach aligns with Google Cloud best practices for sensitive data discovery in unstructured logs by combining custom pattern detection for strict direct identifiers with context-sensitive inspection rule sets for broad quasi-identifiers.

View source documentation

Professional Cloud DevOps Engineer

Cloud Dlp Classify Phi Pii Custom Infotypes Rulesets

Professional Cloud DevOps Engineer

Cloud Dlp Classify Phi Pii Custom Infotypes Rulesets

What Custom Detectors and Inspection Rules Are

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions