An enterprise is building an automated Dataflow pipeline to sanitize structured customer support CSV files before exporting them to BigQuery for analytics. The files contain fixed fields: Customer_ID, SSN, Age, Signup_Date, and a free-text Agent_Notes field. The security team has established the following requirements: Obfuscate SSN by masking all but the last 4 characters. Generalize Age into 10-year intervals (e.g., 20-30, 30-40) without incurring content inspection overhead. Shift Signup_Date by a randomized offset to preserve relative time intervals while protecting exact dates. Detect and replace any sensitive PII (such as email addresses and phone numbers) embedded in the unstructured Agent_Notes column with their respective infoType labels. Centrally manage and decouple transformation configurations from pipeline code using IAM controls. Which Sensitive Data Protection (SDP) configuration should the security team implement?

Create a structured SDP DeidentifyTemplate that defines recordTransformations. Use primitiveTransformation rules with characterMaskConfig for SSN, fixedSizeBucketingConfig for Age, and dateShiftConfig for Signup_Date applied directly to field names. Apply infoTypeTransformations with replaceWithInfoTypeConfig only to the Agent_Notes field, and pass the template ID to the Dataflow pipeline.: What the structured SDP de-identification template is A structured Sensitive Data Protection (SDP) DeidentifyTemplate provides a centralized, reusable, and IAM-governed configuration resource that uses recordTransformations to transform structured tabular datasets (such as CSV files or database tables) at the column or field level. How it meets all requirements Masking SSN: Direct field transformation using characterMaskConfig applies a non-cryptographic character mask to the SSN column, masking all but the specified number of trailing characters without requiring an inspection pass. Bucketing Age: Direct field transformation using fixedSizeBucketingConfig places integer values into predefined discrete ranges (e.g., bucketSize: 10) without content inspection, reducing uniqueness and minimizing API processing overhead. Date Shifting: Direct field transformation using dateShiftConfig shifts dates within a defined lower- and upper-bound range per individual or context, preserving relative time spacing for analytics while obscuring the true date. Sanitizing Free-Text Notes: Applying infoTypeTransformations (with replaceWithInfoTypeConfig) specifically to the Agent_Notes field enables dynamic pattern recognition and replacement of detected PII (such as EMAIL_ADDRESS and PHONE_NUMBER) with token labels. Centralized Pipeline Integration: Managing rules inside an SDP template decouples transformation definitions from the Cloud Dataflow pipeline code, enabling centralized security management and IAM access delegation. Key advantages and capabilities Cost and resource optimization: Performing direct field transformations on known tabular schema columns bypasses the expensive inspectConfig evaluation stage. Targeted inspection: Restricts deeper heuristic scanning exclusively to unstructured text columns (Agent_Notes). Decoupled governance: Allows security administrators to adjust transformation logic and IAM permissions without rebuilding or redeploying ETL pipelines. Why this is optimal This approach aligns with Google Cloud architectural best practices by isolating resource-heavy infoType inspections to unknown/unstructured fields while executing deterministic, non-cryptographic transformations directly against known structured columns via reusable templates.

Sdp Non Cryptographic De Identification Pipeline | Professional Cloud Security Engineer

StudyCerts

Explanations

What the structured SDP de-identification template is

A structured Sensitive Data Protection (SDP) DeidentifyTemplate provides a centralized, reusable, and IAM-governed configuration resource that uses recordTransformations to transform structured tabular datasets (such as CSV files or database tables) at the column or field level.

How it meets all requirements

Masking SSN: Direct field transformation using characterMaskConfig applies a non-cryptographic character mask to the SSN column, masking all but the specified number of trailing characters without requiring an inspection pass.
Bucketing Age: Direct field transformation using fixedSizeBucketingConfig places integer values into predefined discrete ranges (e.g., bucketSize: 10) without content inspection, reducing uniqueness and minimizing API processing overhead.
Date Shifting: Direct field transformation using dateShiftConfig shifts dates within a defined lower- and upper-bound range per individual or context, preserving relative time spacing for analytics while obscuring the true date.
Sanitizing Free-Text Notes: Applying infoTypeTransformations (with replaceWithInfoTypeConfig) specifically to the Agent_Notes field enables dynamic pattern recognition and replacement of detected PII (such as EMAIL_ADDRESS and PHONE_NUMBER) with token labels.
Centralized Pipeline Integration: Managing rules inside an SDP template decouples transformation definitions from the Cloud Dataflow pipeline code, enabling centralized security management and IAM access delegation.

Key advantages and capabilities

Cost and resource optimization: Performing direct field transformations on known tabular schema columns bypasses the expensive inspectConfig evaluation stage.
Targeted inspection: Restricts deeper heuristic scanning exclusively to unstructured text columns (Agent_Notes).
Decoupled governance: Allows security administrators to adjust transformation logic and IAM permissions without rebuilding or redeploying ETL pipelines.

Why this is optimal

This approach aligns with Google Cloud architectural best practices by isolating resource-heavy infoType inspections to unknown/unstructured fields while executing deterministic, non-cryptographic transformations directly against known structured columns via reusable templates.

View source documentation

Professional Cloud Security Engineer

Sdp Non Cryptographic De Identification Pipeline