A security engineer is configuring Google Cloud Sensitive Data Protection (SDP) to inspect customer support logs stored across Cloud Storage buckets and BigQuery datasets. Preliminary inspection scans produced excessive false positives for custom customer account numbers because internal system transaction IDs share the same 9-digit format. In addition, the organization needs to detect employee identifiers across text files against an authoritative corporate roster of 600,000 employee IDs without causing memory or performance bottlenecks. Which configuration should the security engineer implement in the SDP inspection template?

Define a custom regex infoType paired with hotword rules that raise match likelihood based on surrounding proximity terms, and create a stored infoType backed by BigQuery for the employee roster.: What Sensitive Data Protection Inspection Rules and Stored infoTypes Are Sensitive Data Protection (SDP) provides advanced inspection controls, including custom infoTypes, hotword rules, and stored infoTypes (such as large custom dictionaries). These mechanisms allow organizations to tune sensitivity detection, reduce false positives, and efficiently match structured data against massive enterprise datasets. How It Meets the Requirements Tuning likelihood and reducing false positives: Generic 9-digit sequences can match both internal transaction IDs and customer account numbers. By configuring a custom regex infoType with a low baseline likelihood and adding hotword rules (such as looking for terms like account, customer_id, or acct_no within a specific token window), SDP only promotes matches to LIKELY or VERY_LIKELY when contextual tokens are present nearby. Large reference list scalability: Inline dictionaries in SDP inspection templates have size limitations (up to tens of kilobytes). For an employee roster containing 600,000 records, a stored infoType generated from a BigQuery table or Cloud Storage file builds a compact, pre-computed dictionary structure that SDP evaluates efficiently during inspection jobs without exceeding inline API payload limits or degrading scan throughput. Key Advantages and Capabilities Contextual detection accuracy: Hotword rules evaluate prefix and suffix proximity windows to dynamically adjust detection confidence (Likelihood). Enterprise-scale dictionary matching: Stored infoTypes allow searching against millions of phrases or identifiers by storing compiled representations in Google-managed infrastructure. Centralized template reusability: Inspection templates can be shared across multiple discovery profiles, Cloud Storage inspection jobs, and BigQuery data profile scans. Multi-workload coverage: Applies consistent inspection logic uniformly across object storage and analytical data warehouses. Why This Is Optimal Using hotword rules directly addresses format overlap between transaction IDs and account numbers, while leveraging stored infoTypes represents the architectural best practice for high-scale enterprise dictionary lookups in SDP.

Sdp Inspection Template Hotwords Stored Infotypes | Professional Cloud Security Engineer

StudyCerts

Explanations

What Sensitive Data Protection Inspection Rules and Stored infoTypes Are

Sensitive Data Protection (SDP) provides advanced inspection controls, including custom infoTypes, hotword rules, and stored infoTypes (such as large custom dictionaries). These mechanisms allow organizations to tune sensitivity detection, reduce false positives, and efficiently match structured data against massive enterprise datasets.

How It Meets the Requirements

Tuning likelihood and reducing false positives: Generic 9-digit sequences can match both internal transaction IDs and customer account numbers. By configuring a custom regex infoType with a low baseline likelihood and adding hotword rules (such as looking for terms like account, customer_id, or acct_no within a specific token window), SDP only promotes matches to LIKELY or VERY_LIKELY when contextual tokens are present nearby.
Large reference list scalability: Inline dictionaries in SDP inspection templates have size limitations (up to tens of kilobytes). For an employee roster containing 600,000 records, a stored infoType generated from a BigQuery table or Cloud Storage file builds a compact, pre-computed dictionary structure that SDP evaluates efficiently during inspection jobs without exceeding inline API payload limits or degrading scan throughput.

Key Advantages and Capabilities

Contextual detection accuracy: Hotword rules evaluate prefix and suffix proximity windows to dynamically adjust detection confidence (Likelihood).
Enterprise-scale dictionary matching: Stored infoTypes allow searching against millions of phrases or identifiers by storing compiled representations in Google-managed infrastructure.
Centralized template reusability: Inspection templates can be shared across multiple discovery profiles, Cloud Storage inspection jobs, and BigQuery data profile scans.
Multi-workload coverage: Applies consistent inspection logic uniformly across object storage and analytical data warehouses.

Why This Is Optimal

Using hotword rules directly addresses format overlap between transaction IDs and account numbers, while leveraging stored infoTypes represents the architectural best practice for high-scale enterprise dictionary lookups in SDP.

View source documentation

Professional Cloud Security Engineer

Sdp Inspection Template Hotwords Stored Infotypes