A financial enterprise is designing an application-layer data protection pipeline to process customer transaction records before storing them in a shared data repository. The security team established the following technical requirements: Sensitive 10-digit customer account numbers and telephone numbers must be encrypted using Format-Preserving Encryption (FPE) in FFX mode to maintain exact numeric lengths and data types for downstream database compatibility. The transformation must support two-way reversibility (re-identification) by authorized security auditing services. The underlying symmetric data encryption key (DEK) used by the encryption engine must be protected using envelope encryption and wrapped by a Cloud Key Management Service (Cloud KMS) Key Encryption Key (KEK), preventing plaintext DEK exposure in application configurations. Transformed values must include surrogate metadata tags so automated re-identification jobs can identify and reverse the specific field transformation. Which Sensitive Data Protection (Cloud DLP) configuration meets these requirements?

Define a primitive transformation using CryptoReplaceFfxFpeConfig with a KmsWrappedCryptoKey containing the base64-encoded wrapped DEK and Cloud KMS key resource name, set the alphabet to NUMERIC, and specify a SurrogateInfoType.: What Sensitive Data Protection FPE with KMS Wrapped Keys is Sensitive Data Protection (Cloud DLP) provides cryptographic de-identification transformations such as Format-Preserving Encryption (FPE) via CryptoReplaceFfxFpeConfig. FPE encrypts structured input data (such as numeric telephone numbers or account numbers) into ciphertext of the exact same length and character set using the FFX mode of operation (specifically AES-256 in FFX). How it meets the requirements Format-Preserving Encryption and Numeric Compatibility: By configuring CryptoReplaceFfxFpeConfig and choosing CommonAlphabet.NUMERIC, the generated ciphertext preserves character length and the numeric character domain, preventing database schema mismatches. Reversibility (Re-identification): FPE is a two-way cryptographic scheme. Sensitive Data Protection allows re-identification requests (ReidentifyContent) using the same cryptographic key and parameters. Envelope Encryption with Cloud KMS: Instead of supplying an unencrypted UnwrappedCryptoKey, the API supports KmsWrappedCryptoKey. The client provides the base64-encoded encrypted data encryption key (WrappedKey) along with the Cloud KMS resource identifier (CryptoKeyName). Sensitive Data Protection uses Cloud KMS IAM permissions to decrypt the DEK in memory inside Google's secure perimeter. Surrogate Annotations: Defining a SurrogateInfoType wraps or tags the transformed output with a custom infoType token (for example, ACCOUNT_TOKEN(...)), enabling downstream inspection rules to detect surrogate tokens and route them to re-identification pipelines. Key advantages Database Integrity: Preserves original data formats, schemas, and referential constraints without truncation. Strong Key Governance: Leverages Cloud KMS IAM, auditing, and key rotation mechanisms to wrap DEKs. Zero Plaintext DEK Storage: Applications do not need to persist or expose raw AES keys in local environments. Automated Re-identification: Native support for surrogate infoTypes simplifies workflow automation. Why this is optimal This approach combines NIST-standardized format-preserving encryption with automated envelope encryption, ensuring strong cryptographic security and compliance without disrupting relational database schemas.

Sensitive Data Protection Fpe Kms Wrapped Surrogate | Professional Cloud Security Engineer

StudyCerts

Explanations

What Sensitive Data Protection FPE with KMS Wrapped Keys is

Sensitive Data Protection (Cloud DLP) provides cryptographic de-identification transformations such as Format-Preserving Encryption (FPE) via CryptoReplaceFfxFpeConfig. FPE encrypts structured input data (such as numeric telephone numbers or account numbers) into ciphertext of the exact same length and character set using the FFX mode of operation (specifically AES-256 in FFX).

How it meets the requirements

Format-Preserving Encryption and Numeric Compatibility: By configuring CryptoReplaceFfxFpeConfig and choosing CommonAlphabet.NUMERIC, the generated ciphertext preserves character length and the numeric character domain, preventing database schema mismatches.
Reversibility (Re-identification): FPE is a two-way cryptographic scheme. Sensitive Data Protection allows re-identification requests (ReidentifyContent) using the same cryptographic key and parameters.
Envelope Encryption with Cloud KMS: Instead of supplying an unencrypted UnwrappedCryptoKey, the API supports KmsWrappedCryptoKey. The client provides the base64-encoded encrypted data encryption key (WrappedKey) along with the Cloud KMS resource identifier (CryptoKeyName). Sensitive Data Protection uses Cloud KMS IAM permissions to decrypt the DEK in memory inside Google's secure perimeter.
Surrogate Annotations: Defining a SurrogateInfoType wraps or tags the transformed output with a custom infoType token (for example, ACCOUNT_TOKEN(...)), enabling downstream inspection rules to detect surrogate tokens and route them to re-identification pipelines.

Key advantages

Database Integrity: Preserves original data formats, schemas, and referential constraints without truncation.
Strong Key Governance: Leverages Cloud KMS IAM, auditing, and key rotation mechanisms to wrap DEKs.
Zero Plaintext DEK Storage: Applications do not need to persist or expose raw AES keys in local environments.
Automated Re-identification: Native support for surrogate infoTypes simplifies workflow automation.

Why this is optimal

This approach combines NIST-standardized format-preserving encryption with automated envelope encryption, ensuring strong cryptographic security and compliance without disrupting relational database schemas.

View source documentation

Professional Cloud Security Engineer

Sensitive Data Protection Fpe Kms Wrapped Surrogate