Cloud Digital Leader Google Cloud Security Practice Question
A company wants to scan its Cloud Storage buckets for sensitive data like credit card numbers and social security numbers. Which service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitive Data Protection
Sensitive Data Protection (DLP API) is used to inspect and de-identify sensitive data. Security Command Center is for vulnerabilities. Web Risk API checks URLs against threat lists. reCAPTCHA is for bot protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Command Center
Why it's wrong here
Security Command Center is Google Cloud's security and compliance management platform that aggregates findings and monitors for threats, vulnerabilities, and misconfigurations. However, it does not include a content inspection engine capable of scanning object data within Cloud Storage for sensitive patterns such as PII or payment card numbers. While SCC can ingest findings from Sensitive Data Protection jobs, it does not perform the underlying data discovery itself, so it is not the correct service for this task.
- ✓
Sensitive Data Protection
Why this is correct
Sensitive Data Protection (formerly Cloud DLP) is the correct service because it provides native data discovery, classification, and de-identification. You can create inspect jobs that scan Cloud Storage buckets using predefined or custom infoTypes to detect sensitive data like credit card numbers, names, or addresses. It supports both full scans and time-based sampling, and integrates with other security services for remediation.
- ✗
reCAPTCHA Enterprise
Why it's wrong here
reCAPTCHA Enterprise is designed to protect websites and APIs from automated bot traffic, fraud, and abuse by analyzing user interactions like mouse moves and keystroke timing. It does not inspect the content of files or objects at rest, nor does it have any pattern-matching capabilities for sensitive data. Therefore, it cannot scan Cloud Storage buckets for sensitive information and is not a valid answer to this requirement.
- ✗
Web Risk API
Why it's wrong here
Web Risk API is a threat intelligence service that checks URLs and domains against Google's lists of phishing, malware, and unwanted software sites. It works at the URL level, not at the data content level, so it cannot examine the bytes inside objects stored in Cloud Storage buckets. Since it lacks the ability to parse or match sensitive-data patterns, it is unsuitable for scanning for sensitive information.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.