Exam Professional Cloud Security Engineer topic 1 question 94 discussion

D. Perform tokenization for Pseudonymization with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.

D is the answer as tokenization can support re-identification for use by HR. https://cloud.google.com/dlp/docs/pseudonymization

"D" Out of all the options listed, pseudonymization is the only reversible method which is one of the requirements in the quest. https://cloud.google.com/dlp/docs/transformations-reference#transformation_methods https://cloud.google.com/dlp/docs/pseudonymization

Both A & D will do the job. But, A is preferred as the data is PII and needs to be secure. https://cloud.google.com/dlp/docs/pseudonymization#how-tokenization-works Why A is not a apt response: https://cloud.google.com/bigquery/docs/column-data-masking-intro The SHA-256 function used in data masking is type preserving, so the hash value it returns has the same data type as the column value. SHA-256 is a deterministic hashing function; an initial value always resolves to the same hash value. However, it does not require encryption keys. This makes it possible for a malicious actor to use a brute force attack to determine the original value, by running all possible original values through the SHA-256 algorithm and seeing which one produces a hash that matches the hash returned by data masking.

D, as tokenization supports re-identification for the HR team

B is okay Data redaction, as opposed to data masking or tokenization, completely removes or replaces the sensitive fields, making it so that the operations teams cannot see the sensitive information. This ensures that the sensitive data is only available to the Human Resources team on a need-to-know basis, as per the privacy regulations. The Cloud Data Loss Prevention API is able to inspect and redact data, making it a suitable choice for this task.

D is correct Pseudonymization is a de-identification technique that replaces sensitive data values with cryptographically generated tokens. Pseudonymization is widely used in industries like finance and healthcare to help reduce the risk of data in use, narrow compliance scope, and minimize the exposure of sensitive data to systems while preserving data utility and accuracy.

A https://cloud.google.com/bigquery/docs/column-data-masking-intro