mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Ensure that Cloud DLP scans all data uploaded to…
You need to ensure that Cloud DLP scans all data uploaded to a specific Cloud Storage bucket and redacts any Social Security Numbers (SSNs) before storing the data. Which Cloud DLP feature and trigger enables this pattern?
⚠ Common exam trap
Google Cloud often tests the misconception that Cloud DLP can be directly attached to a Cloud Storage bucket for automatic redaction, but in reality, you must orchestrate the inspection and redaction via an event-driven compute service like Cloud Functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Pub/Sub notifications on the bucket to trigger a Cloud Function that calls Cloud DLP to redact SSNs before the file is readable.
Cloud DLP cannot directly intercept and redact data at the point of upload to Cloud Storage. Instead, you must use Pub/Sub notifications on the bucket to trigger a Cloud Function, which calls the Cloud DLP API to inspect and redact SSNs before the file is stored or made readable. This pattern ensures redaction happens in near real-time as part of the upload pipeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Cloud DLP auto-redaction on the Cloud Storage bucket via the GCS settings.
Why it's wrong here
There is no native toggle or bucket-level setting in Cloud Storage for 'DLP auto-redaction'; DLP does not automatically plug into GCS write paths. To get DLP redaction on upload, you must explicitly build an event-driven pipeline—for example, Cloud Functions or Cloud Run subscribed to Pub/Sub notifications, or Dataflow streaming—that calls the DLP API and writes back sanitized objects. The availability of DLP templates or inspection jobs does not create a direct GCS integration.
- ✓
Configure Pub/Sub notifications on the bucket to trigger a Cloud Function that calls Cloud DLP to redact SSNs before the file is readable.
Why this is correct
This is correct because the standard event-driven pattern is to create a Pub/Sub topic, enable bucket notifications for OBJECT_FINALIZE events, and use a Cloud Function to call Cloud DLP's content inspection/de-identification API. The function applies an InspectConfig with the US_SOCIAL_SECURITY_NUMBER infoType and a DeidentifyConfig with a redaction transformation, then writes the redacted object, optionally deleting or quarantining the original. This runs synchronously upon object creation, ensuring the file is not publicly readable until PII is removed.
- ✗
Use Cloud DLP's scheduled inspection job to scan the bucket daily and flag SSNs.
Why it's wrong here
A scheduled inspection job runs periodically and only scans for the configured infoTypes, generating a report of findings; it does not modify the object or remove SSNs. Because it runs daily (or on a custom schedule), any newly uploaded file could be visible with unredacted SSNs until the next scan. Real-time protection requires an event-triggered de-identification workflow, not a batch inspection job.
- ✗
Apply an org policy that prevents storing SSNs in Cloud Storage.
Why it's wrong here
Organization policies only govern resource-level attributes like location, encryption, or service identity; they cannot inspect object contents or enforce data-classification rules. There is no org policy constraint that detects or blocks specific bytes like SSNs, because org policy evaluation happens at the resource management layer, not inside storage data paths. Content-driven control requires Cloud DLP, which is why this option cannot prevent storing SSNs in practice.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Pub/Sub
Pub/Sub is a messaging pattern where publishers send messages without knowing who receives them, and subscribers receive only the messages they care about.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.