Google Cloud Digital Leader (GCDL) — Questions 751–825

Folders under the organization node establish a resource hierarchy where each department's folder can have IAM policies and billing defaults applied, cascading to all projects within. This separates access control by making the department folder an administrative boundary, and also allows aggregated billing per folder by linking a dedicated billing account to that folder, which individual projects inherit.

Cloud Tasks decouples the image processing workload from the Cloud Function trigger, immediately returning a response to the client. Each upload is enqueued as a task that Cloud Run processes asynchronously, allowing you to configure timeouts up to 60 minutes or more. Cloud Run also scales to zero when idle, so you only pay for the processing time, and Cloud Tasks provides automatic retries for transient failures.

App Engine is a fully managed Platform-as-a-Service (PaaS) that abstracts away all underlying infrastructure, including servers, networking, and scaling. It automatically scales your web application based on traffic, handles load balancing, and provides built-in health checks, allowing developers to simply deploy code and focus on feature development. This aligns perfectly with a company that wants to migrate to the cloud and prioritize building without operational overhead.

Labels are key-value pairs that can be applied to all Google Cloud resources and are indexed by Cloud Billing for cost allocation and reporting. Adding an `environment` label to each resource allows the organization to break down costs by environment, ensuring accurate cost tracking and chargeback. This satisfies the requirement of enforcing cost tracking, which labels are specifically designed for.

This architecture directly implements the required behavior: Pub/Sub ingests a continuous stream of events such as web traffic, competitor price feeds, and inventory levels, while Dataflow performs windowed feature computation and invokes a Vertex AI model to score the optimal price per product. Because Dataflow auto-scales its worker pool, millions of events per minute can be processed without manual capacity planning, and Vertex AI's online prediction service returns scored prices in the tens of milliseconds. The resulting price updates are written to a serving database and pushed to the storefront, enabling true minutes-level dynamic pricing.

Mandiant is Google Cloud's front-line threat intelligence and incident response unit, offering curated cyber threat intelligence, threat actor research, and on-demand incident response consulting. Its services include digital forensics, compromise assessments, and strategic intelligence, making it the direct match for this question's description of providing threat intelligence and incident response.

Security Command Center (SCC) is Google Cloud's centralized security and risk management platform, and it provides built-in vulnerability scanning for Compute Engine VMs and GKE container images. It aggregates findings from native Google Cloud services and partner security tools into a single view, then uses severity scores, exposure data, and attack path simulation to help security teams prioritize which vulnerabilities to remediate first. This directly matches the requirement to detect and prioritize vulnerabilities across a cloud environment.

Data security is the correct layer because it directly protects the confidentiality and integrity of the data itself through encryption. Google uses TLS for data in transit and AES-256 (or stronger) for data at rest, managed via Cloud KMS. This layer also includes key management, data classification, and DLP policies.

Anthos is a hybrid and multi-cloud application platform built on Google Kubernetes Engine (GKE) and the Kubernetes ecosystem, enabling consistent deployment, policy management, and service mesh across on-premises clusters and Google Cloud. It allows organizations to modernize existing applications, run them anywhere, and apply uniform governance, making it the core component for a hybrid cloud strategy that retains sensitive workloads on-premises.

BigQuery is a serverless, fully managed data warehouse with columnar storage and a distributed execution engine, purpose-built for petabyte-scale SQL analytics. It separates compute from storage, enabling sub-second interactive queries over massive datasets without provisioning clusters. Its native support for standard SQL, partitioning, and clustering makes it the ideal service for analyzing petabytes of sales data.

Preemptible VMs offer up to an 80% discount compared to on-demand instances but may be terminated by Compute Engine at any time, with a maximum runtime of 24 hours. Since the nightly analytics job is batch-oriented and fault-tolerant, it can handle these interruptions via restart or checkpointing, making preemptible VMs the most cost-effective and appropriate choice. This aligns the compute pricing model with the workload's tolerance for interruption.

Bigtable is a fully managed, wide-column NoSQL database designed for massive scale, handling millions of writes per second with sub-10ms latency. It is ideal for high-throughput, time-series, or IoT data where each user profile is keyed by a row key and columns can be dynamically added. However, its strengths are in analytical and operational workloads with large volumes, not necessarily the best fit for a simple mobile app user profile, yet it works if data volume is extremely high and latency is critical.

This is the core lesson. Cloud is an enabler of agility, not a guarantor. Without automated CI/CD pipelines, continuous testing, and frequent deployment cadences, quarterly releases persist regardless of whether code runs on cloud or on-premises VMs. DevOps practices and cloud infrastructure must be adopted together.

Public cloud platforms like Google Cloud provide self-service, on-demand provisioning with pay-as-you-go pricing, requiring no capital investment. Their elastic auto-scaling handles unpredictable traffic by adjusting resources in real time, and users only pay for what they consume. This makes it the ideal choice for a startup that needs to minimize upfront costs while maintaining flexibility.

Cloud CDN combined with a global external HTTP(S) load balancer uses Google's worldwide edge points of presence to cache static and dynamic content close to users. The load balancer intelligently routes each request to the nearest edge location, minimizing round-trip time and offloading requests from the backend. This architecture is specifically designed to deliver low-latency experiences to a global customer base.

The BAA is non-negotiable for HIPAA compliance. Google Cloud offers a BAA that covers specific services for HIPAA workloads. Without a BAA in place, any PHI stored in Google Cloud constitutes a HIPAA violation — technical security controls alone do not satisfy the legal requirement.

Cloud Spanner is a fully managed, horizontally scalable relational database that combines standard SQL transactions with globally distributed replication. It uses TrueTime (a globally synchronized clock) and Paxos consensus to provide strong external consistency across all regions, meaning reads and writes are always linearizable even during failovers. With a 99.999% availability SLA and the ability to write from any region, it is the only option among these that supports globally consistent relational data at scale.

This is the data-to-action pipeline that creates competitive advantage: real-time social/search data ingested at cloud scale reveals trends early; ML identifies patterns; supply chain APIs allow rapid response. The combination of early trend detection and fast execution creates a competitive moat.

This is the correct explanation. Billing models match consumption patterns: VMs consume CPU/memory as long as they run (time-based), while storage accumulates data that persists over time (data×time). This measured service model ensures billing is proportional to actual resource use.

Mandiant is Google Cloud's managed threat detection and response service, combining front-line expertise from Mandiant's incident response consultants with automated threat hunting and forensic capabilities. It is purpose-built for investigating advanced persistent threats, containing breaches, and performing root cause analysis, unlike logging or network filtering services. This makes Mandiant the direct match for a security team's requirement to detect and respond to sophisticated threats.

BeyondCorp Enterprise is Google's comprehensive zero-trust security solution. It shifts access decisions from the network perimeter to identity and context: each request is evaluated against the user's identity, device trust level, and contextual signals before granting access. By combining Identity-Aware Proxy, endpoint verification, threat/DPA protections, and security analytics, BeyondCorp Enterprise provides continuous, adaptive verification for both cloud and on-premises resources. This makes it the full framework rather than a single point solution.

Selecting EU regions for every resource ensures that data at rest is physically stored within EU boundaries, directly meeting residency requirements. Applying the gcp.resourceLocations organization policy adds a preventive control that blocks creation of any resource outside the allowed EU regions, even by accident or through a misconfigured deployment. This combination of explicit region selection and org-level policy enforcement is the accepted GCP method for guaranteeing data residency across all projects in an organization.

Cloud Dataflow is Google Cloud's fully managed implementation of Apache Beam, designed for both real-time stream processing and batch processing with a unified programming model. It ingests events from Pub/Sub, applies user-defined transforms (PTransforms) for enrichment, filtering, and aggregation, and writes results to BigQuery using connectors. Dataflow handles autoscaling, exactly-once processing, and event-time windowing automatically, making it the standard GCP service for building streaming pipelines that transform data before analysis.

The roles/pubsub.publisher role contains exactly the pubsub.topics.publish permission required to send messages to a topic. Attaching this role as a binding on the specific topic resource restricts the grant to that single topic, so the service account cannot publish to any other topics in the project. This is the least-privilege approach because it grants the minimal permission on the narrowest resource scope that still fulfills the requirement.

Pub/Sub provides a fully managed, asynchronous messaging service with durable message retention, at-least-once delivery, and replay support, enabling reliable, scalable stream ingestion with no operators. Cloud Dataflow, built on Apache Beam, processes streams in real time and supports event-time processing, watermarks, windowing, and exactly-once semantics, making it suitable for complex transformations, aggregations, and stateful analytics. As a fully managed service, it also autoscales and seamlessly integrates with GCP and open-source ecosystems, so this combination is the intended architecture for real-time stream processing on GCP.

The organization node is the root of the Google Cloud resource hierarchy. Organization policies set at this level are inherited by every folder and project beneath it, including future projects that are created later. This is the only placement that guarantees the policy is enforced uniformly across all projects in the organization without any per-project or per-folder exceptions.

Cloud Secret Manager is the native Google Cloud service designed specifically to store and manage API keys, passwords, and other sensitive strings. It provides centralized IAM-based access control, automatic secret versioning, configurable rotation policies, and full audit logging via Cloud Audit Logs. Secrets can be encrypted with customer-managed keys (CMEK) using Cloud KMS, and the service integrates with Compute Engine and GKE for runtime secret injection. This combination of fine-grained access, lifecycle management, and integration makes it the correct and secure choice.

On-demand self-service is the NIST cloud characteristic that lets a consumer unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. This is the precise capability described in the question: the user accesses a portal or API and immediately spins up resources, eliminating manual procurement or IT ticket workflows. It is the defining user-facing attribute of cloud computing that differentiates it from traditional IT, where a human administrator must manually allocate capacity — and it directly matches the scenario's requirement for automatic provisioning.

Cloud Armor is the correct choice because it combines distributed denial-of-service (DDoS) protection with a web application firewall (WAF) at the Google Cloud edge. It offers preconfigured rules for the OWASP Top 10, including SQL injection (SQLi) and cross-site scripting (XSS), and can enforce these rules inline as traffic passes through Cloud Load Balancing. Cloud Armor also provides adaptive protection, rate limiting, and edge security policies to mitigate volumetric DDoS attacks. This dual capability directly addresses both the DDoS and SQL injection threats described in the scenario.

Principle of least privilege is the security doctrine mandating that any user, process, or system component be granted only the minimum permissions essential to perform its prescribed functions. By restricting privileges to the exact scope of job duties, it minimizes the attack surface and contains the blast radius of a compromised credential, preventing lateral movement or unauthorized data access. This principle is foundational to access control and directly answers the question about how much permission a user should receive.

Archive is the correct storage class because it is the lowest-cost option for long-term retention, designed specifically for data accessed less than once per year. It enforces a 365-day minimum storage duration, which aligns with archival retention needs where retrieval is rare and latency is acceptable. Its pricing model minimizes storage cost at the expense of higher retrieval fees, making it the most economical choice for compliance or forensic archives.

GAUGE metrics capture a value at a single point in time, like a snapshot, so there is no temporal difference to divide by an elapsed interval. Cloud Monitoring's rate aligner (ALIGN_RATE) or the 'rate' transform requires DELTA or CUMULATIVE metrics to compute per-second change. Because the metric is GAUGE, it is structurally impossible to calculate a rate, regardless of the interval or value type.

Cloud Storage is Google's fully managed, globally distributed object storage service designed for unstructured data such as images, videos, backups, and datasets. It stores objects as immutable blobs in buckets, with a flat namespace and HTTP/S APIs, enabling access from anywhere via standard web protocols. It offers 11 nines of annual durability (99.999999999%) through redundant storage across multiple locations, and its scalability and lifecycle management make it ideal for data lakes, content distribution, and archival storage.

This is the complete two-layer approach: prevention (org policy blocks future non-compliant resources at creation time) and detection/remediation (Cloud Asset Inventory finds existing unlabeled resources so they can be labeled retroactively). Together they address both the future and existing state.

Cloud Armor provides built-in protections against volumetric DDoS attacks and a web application firewall (WAF) to block OWASP Top 10 threats like SQL injection and cross-site scripting. It uses preconfigured rules and adaptive protection to filter malicious traffic at the edge, only forwarding legitimate requests to backend services. This makes it the primary DDoS and application-layer security service for applications fronted by Cloud Load Balancing.

Workflows is the purpose-built orchestration service. It defines steps that call Cloud Build API, evaluate results, and conditionally proceed to Cloud Run deployment or notification — exactly the described use case. It handles retries, parallelism, and state automatically.

Cloud CDN caches static and dynamic content at Google's global edge points of presence, so users retrieve data from a location geographically close to them. This reduces round-trip time, decreases latency, and unloads the origin server, directly improving the performance of a global e-commerce application's page loads and media delivery.

Cloud EKM integrates the Cloud KMS API with an external key management system or on-premises HSM, allowing Google Cloud services to encrypt and decrypt data at rest using keys that never leave the external HSM in plaintext. This preserves customer control and satisfies the requirement for keys to be stored outside the cloud provider's environment.

Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities, DDoS protection, and IP reputation filtering at the global edge, directly integrated with Cloud Load Balancing. It can inspect HTTP(S) traffic, block malicious requests based on Layer 7 attributes like headers and body, and enforce allow/deny lists based on IP addresses and geolocation. This gives the organization precise, policy-based control over incoming traffic before it reaches backend instances.

Access Transparency is the correct service because it provides logs of actions taken by Google personnel (e.g., Cloud Support or Site Reliability Engineers) on the content of your data and the metadata of your resources. It uses the same audit log framework but specifically surfaces events where Google staff access customer data, and it distinguishes these from customer-initiated API calls. Administrators can route these logs to Cloud Logging or Pub/Sub to set up alerts, giving the security team the exact visibility they need into human access by Google employees.

Admin Activity audit logs record all IAM policy changes (SetIamPolicy calls) automatically and cannot be disabled. A log-based metric in Cloud Monitoring can count these events, and an alerting policy triggers a notification whenever an IAM change is detected. This is the standard approach for IAM change monitoring.

A blameless postmortem is a retrospective, collaborative analysis of an incident that produces a written record containing a detailed timeline, impact assessment, root cause analysis (often using techniques such as '5 Whys' or cause-effect diagrams), and concrete preventive actions. The 'blameless' attribute ensures the investigation concentrates on systemic contributions — like incomplete monitoring, ambiguous runbooks, or brittle configurations — rather than punishing the operator who triggered the failure. This approach builds psychological safety, enabling honest reporting of contributing factors, and turns failures into opportunities for continuous improvement, which is a fundamental pillar of reliability engineering.

Measured service is one of NIST's five essential characteristics of cloud computing, requiring that cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, or active user accounts). This metering provides transparency for both the provider and consumer, enabling pay-per-use billing, capacity planning, and monitoring of usage against service-level agreements. It fundamentally differentiates cloud computing from traditional IT by transforming fixed infrastructure costs into variable costs tied directly to consumption.

App Engine is a fully managed platform-as-a-service that accepts your source code and runtime configuration directly, without requiring you to build or manage containers. It automatically provisions underlying compute resources, performs health checks, balances load across instances, and scales from zero to many based on traffic. Patches and infrastructure maintenance are handled by Google, making it the most operationally lightweight choice for deploying a web application.

Archive storage class provides the lowest per-gigabyte storage cost in Cloud Storage and is explicitly designed for data accessed less than once a year. With a 180-day minimum retention period and default millisecond access latency, it aligns perfectly with a 10-year retention strategy for petabytes of transaction data. The rare access pattern means retrieval fees stay negligible, and the 180-day constraint is easily satisfied by the long retention, making Archive the most economical and technically appropriate choice.

Preemptible VMs are instances that run on Google Cloud's surplus capacity at a fraction of the normal cost, often up to 80% cheaper. They can be terminated abruptly by Google Cloud, but a batch job that runs only once per day and can tolerate interruptions is an ideal candidate. By designing the job to restart or resume from checkpoints, the company can achieve substantial cost savings while maintaining reliability.

This accurately captures the key trade-off. Microservices' benefits (independent scale, isolated failures, technology diversity) come with real operational costs: inter-service communication adds latency and failure modes, distributed tracing replaces simple stack traces, and data consistency across services requires careful design.

An SLI defined as good events divided by total events is the canonical, user-centric approach for an API service, as it directly measures the proportion of requests that meet predefined success criteria. For example, a request may be considered 'good' if it returns an HTTP 2xx status and has a latency below a threshold, while 'total events' counts every request received. This ratio yields a percentage that aligns with the actual user experience and forms the basis for setting an SLO and calculating an error budget, following standard SRE practices.

BeyondCorp Enterprise is Google Cloud's complete zero-trust access solution, designed to replace a traditional VPN. It enforces access decisions based on user identity, device security posture, and context, rather than granting broad network-level entry. By combining Identity-Aware Proxy, endpoint verification, and adaptive policies into a single platform, it protects applications without exposing the entire network, which is why it is the correct replacement for VPN-based remote access.

This correctly captures the core cost-model shift of cloud adoption. In an on-premises model, you must buy and capitalize expensive hardware, software licenses, and data-center infrastructure upfront, and then depreciate those assets over their useful life. Cloud providers own the infrastructure and charge variable usage fees, so customers avoid large capital outlays and instead book monthly cloud bills as operating expenses. This improves cash flow and aligns costs with actual business consumption, which is exactly the CapEx-to-OpEx transition.

CUDs are purchased at the resource level, meaning you commit to a specific quantity of a particular resource type, such as virtual CPUs (vCPUs), memory (GB), or GPUs, within a given region or machine family. This allows you to receive a discounted rate for all matching usage that falls within the committed amount. For example, you might commit to 100 vCPUs in us-central1 for 3 years and pay a reduced hourly rate for those vCPUs, regardless of which compatible VM uses them.

Binary Authorization is a supply-chain security control that requires all container images to be signed by an approved authority before admission to the cluster. It integrates with Artifact Analysis and your CI/CD pipeline, using attestors to verify signatures and enforce policies like 'only images signed for production' at deployment time. This blocks unverified or tampered images from running, directly closing a key attack vector.

Since 2017, Google has matched 100% of the electricity its global operations (including Cloud regions) consume with an equivalent amount of renewable energy. This is achieved by entering into long-term PPAs (e.g., wind and solar) that add new renewable capacity to the grid, and by using market-based instruments without double-counting. This claim is verified annually through third-party audits under the Greenhouse Gas Protocol scope 2 accounting.

Compute Engine is a true Infrastructure-as-a-Service offering, giving you full administrative control over a Windows Server VM. You can install custom patches, enable and configure IIS, alter registry settings, and manage the OS exactly as required by your legacy application. This is the only option that provides direct OS-level access, making it the correct choice for a lift-and-shift migration of a Windows workload that cannot be refactored.

Cloud Billing Budgets and Alerts is the native GCP service for defining budget amounts at the billing account or project level and setting threshold rules (e.g., 50%, 90%, 100% of budget). It automatically sends notifications via email and Pub/Sub when thresholds are crossed, enabling proactive cost governance and integration with automation workflows. This is the primary, purpose-built tool for monitoring spending and receiving budget alerts.

SLIs are the specific measurable quantities that capture how users experience the service. Latency (is it fast enough?), error rate (is it working?), and throughput (is it keeping up?) are the canonical SLI types. Together they provide a quantitative picture of reliability that can be used to set SLO targets.

BigQuery is Google Cloud's serverless, fully managed data warehouse built on a columnar storage format and the Dremel massively parallel query engine, letting you run SQL over petabytes without provisioning. Its compute and storage are decoupled, so it scales elastically and you pay only for queries and stored data; native Looker integration and BI Engine in-memory acceleration directly support analytical workloads. That combination of serverless scalability, ANSI SQL, and built-in BI connectivity is what makes it the correct answer.

Persistent Disk Snapshots are the correct mechanism. They capture a consistent point-in-time image of the disk (application-consistent when used with snapshot agent or after flushing I/O). Snapshots are stored in Cloud Storage, incremental after the first snapshot, and can be used to create a new disk or restore data.

Cloud Firestore is a flexible, serverless NoSQL document database designed specifically for mobile and web clients, with real-time synchronization via listen callbacks and automatic offline data persistence. Its hierarchical data model organizes user profiles naturally as documents within collections, and security rules integrate directly with client SDKs. Unlike global SQL options, Firestore provides built-in multi-device sync and conflict handling, making it the ideal fit for a mobile app storing user profiles.

VPC Service Controls define security perimeters around Google Cloud resources such as Cloud Storage and BigQuery, using context-aware access conditions (identity, IP, device) to block data exfiltration. It works at the API layer, independent of VPC network boundaries, and is the only option here that actively restricts data movement outside a defined perimeter.

Cloud Run is the correct choice because it is a fully managed serverless platform that executes stateless containers in a scale-to-zero model, abstracting away all infrastructure such as clusters, nodes, and VMs. You simply deploy a container image and Cloud Run automatically provisions, scales, and load-balances the instances based on incoming HTTP requests or events, billing only for the resources used during request processing. This makes it ideal for containerized workloads where you want zero cluster management and event-driven autoscaling, without the operational overhead of Kubernetes or virtual machines.

Using the Cloud Healthcare API to ingest and standardize data from each department addresses silos by converting disparate formats (e.g., FHIR, HL7v2, DICOM) into consistent, interoperable schemas. The standardized data is loaded into BigQuery, a fully managed, HIPAA-eligible serverless data warehouse, allowing analysts to query across the entire hospital chain without managing infrastructure. BigQuery ML enables building and deploying predictive models directly on the warehouse using SQL, avoiding the need for separate ML training environments. This combined solution is scalable, secure, and operationally efficient, making it the optimal choice for advanced analytics.

Preemptible VMs cost up to 80% less than standard VMs, making them ideal for fault-tolerant workloads that can survive instance termination, such as batch data processing, rendering, or stateless web serving. This cost benefit is the primary purpose of using them, not performance or availability, and it enables large-scale compute tasks under a constrained budget.

BigQuery is precisely designed for this use case. Its serverless architecture, columnar storage format, and distributed query engine make it ideal for analysts running complex SQL against massive datasets. The weekly report workload is a canonical BigQuery use case.

Persistent Disk is a network-attached block storage service that can be attached to a single VM as a raw device, providing durable and high-performance storage. It is independent of the VM lifecycle, so data persists even when the VM is stopped or terminated, and it supports snapshots and regional replication for added durability. This makes it the correct choice for a stateful application that needs reliable block storage while allowing the VM to be restarted or migrated.

Multi-region deployment is required to survive a full regional outage. By running active or active-passive instances in multiple distinct geographic regions, the system continues operating when any single region fails. Each region is geographically and infrastructure-independently isolated.

A notification is sent to the configured Pub/Sub topic—this is the correct and primary behavior of a budget alert. When spending (or forecasted spending) exceeds a threshold, the Cloud Billing service publishes a message containing details like the budget name, current cost, and threshold value to the topic you selected. This message can then be consumed by Cloud Functions, Cloud Run, or other services to trigger automated responses, but the alert itself only delivers the notification.

Deploying instances across multiple zones within the same region keeps compute close to users and each other, with one-way network latency typically under 1-2 ms, while protecting against entire data center failures. A regional managed instance group can distribute instances across zones and use health checks to automatically replace failed VMs, ensuring the application remains available during a zone outage without forcing cross-geography traffic.

The dev folder is the node in the resource hierarchy that contains only development projects and subfolders under eng; applying the policy there inherits to all of those descendants. Because the policy does not flow upward or to sibling folders like test or prod, this is the precise way to scope the restriction to just the dev environment. It leverages the hierarchy to define the policy exactly where the environment boundary is intended.

The organization policy constraint `gcp.resourceLocations` is the correct mechanism because it actively enforces geographic compliance at resource creation time. By defining an allowlist of permitted locations at the organization, folder, or project level, Google Cloud blocks any attempt to create a resource outside those regions. This is a centralized, context-aware enforcement that works across supported services, making it the native, authoritative way to guarantee workloads run only in mandated locations.

Data-driven decision making (DDDM) is the organizational practice of making business choices based on objective data analysis, with executives defining key metrics and empowering teams to act on findings rather than relying on positional authority or gut feel. In a cloud context, DDDM is enabled by unified data platforms, self-service analytics, and real-time pipelines, but the technology alone is insufficient—leadership commitment to trust the data, tolerate failures from experiments, and change decision rights is the actual cultural change. This is the correct answer because the question describes a cultural shift, not a tool.

Cloud Monitoring uptime checks are a managed, synthetic monitoring solution that sends HTTP, HTTPS, or TCP probe requests to your endpoints from multiple global points of presence (PoPs) at configurable intervals. Alerting policies can be triggered when a configurable number of locations report failure, which verifies external availability from the user's perspective, not just internal health. This is the correct choice because it is a deliberately designed, low-maintenance service for exactly this use case, requiring no custom infrastructure and providing global coverage by default.

The Data Loss Prevention (DLP) API is specifically designed to inspect, classify, and protect sensitive data by scanning content for predefined infoTypes (e.g., names, credit card numbers, national ID numbers) and custom patterns. It can analyze text, structured data, and even images via OCR, then classify findings and optionally apply de-identification transformations like redaction or tokenization. This makes it the correct service for identifying and classifying sensitive data.