Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A financial enterprise is designing an application-layer data protection pipeline to process customer transaction records before storing them in a shared data repository. The security team established the following technical requirements:
Which Sensitive Data Protection (Cloud DLP) configuration meets these requirements?
Sensitive Data Protection (Cloud DLP) provides cryptographic de-identification transformations such as Format-Preserving Encryption (FPE) via CryptoReplaceFfxFpeConfig. FPE encrypts structured input data (such as numeric telephone numbers or account numbers) into ciphertext of the exact same length and character set using the FFX mode of operation (specifically AES-256 in FFX).
CryptoReplaceFfxFpeConfig and choosing CommonAlphabet.NUMERIC, the generated ciphertext preserves character length and the numeric character domain, preventing database schema mismatches.ReidentifyContent) using the same cryptographic key and parameters.UnwrappedCryptoKey, the API supports KmsWrappedCryptoKey. The client provides the base64-encoded encrypted data encryption key (WrappedKey) along with the Cloud KMS resource identifier (CryptoKeyName). Sensitive Data Protection uses Cloud KMS IAM permissions to decrypt the DEK in memory inside Google's secure perimeter.SurrogateInfoType wraps or tags the transformed output with a custom infoType token (for example, ACCOUNT_TOKEN(...)), enabling downstream inspection rules to detect surrogate tokens and route them to re-identification pipelines.This approach combines NIST-standardized format-preserving encryption with automated envelope encryption, ensuring strong cryptographic security and compliance without disrupting relational database schemas.
Date shifting via DateShiftConfig is a de-identification transformation designed specifically for date, time, and timestamp fields. It shifts dates by a pseudorandom number of days determined within specified upper and lower bounds, using an optional context field to maintain relative temporal consistency across related user records.
DateShiftConfig operates on date and datetime objects, not arbitrary numeric strings such as 10-digit telephone or account numbers.SurrogateInfoType configurations for token tracking.KmsWrappedCryptoKey to secure the seed generation key.The scenario required obfuscating customer transaction dates and date-of-birth fields while preserving chronological intervals across multi-table joins.
CryptoReplaceFfxFpeConfig with an UnwrappedCryptoKey executes format-preserving encryption by passing a raw, plaintext base64-encoded AES key directly across the API request payload.
UnwrappedCryptoKey transmits and manages the raw AES symmetric key in application memory and configurations, violating the requirement to use envelope encryption wrapped by a Cloud KMS Key Encryption Key (KEK).SurrogateInfoType means the transformed output cannot be easily identified as a surrogate token by downstream re-identification routines, breaking automated two-way workflows.The workload operated in a standalone environment without access to Cloud KMS and did not require surrogate infoType tagging.
CryptoHashConfig performs one-way cryptographic hashing (such as HMAC-SHA256) over sensitive input strings using an ephemeral (TransientCryptoKey) or persistent key.
TransientCryptoKey is generated ephemerally per request and discarded, making consistent mapping or decryption impossible.The scenario required one-way irreversibility (pseudonymization) to correlate cross-dataset records without allowing any entity to recover the original plaintext values.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated