Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company wants to ensure that sensitive data (credit card numbers, SSNs) stored in BigQuery is automatically identified and protected. They also want ongoing scanning to detect if any new data violates their data governance policies. Which Google Cloud service provides these capabilities?
⚠ Common exam trap
Many candidates confuse Security Command Center's broad security scanning with Cloud DLP's specific data-level inspection, or assume that logging or monitoring tools can perform content analysis without specialized pattern-matching engines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.
Cloud DLP with BigQuery inspection jobs is the correct choice because it provides both automated identification of sensitive data (such as credit card numbers and SSNs) within BigQuery tables and ongoing scanning capabilities via scheduled inspection jobs. Cloud DLP uses built-in infoType detectors to match patterns like credit card numbers (Luhn check) and SSNs, and can trigger actions or alerts when new data violates governance policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Command Center — it scans BigQuery for sensitive data automatically.
Why it's wrong here
Security Command Center (SCC) is a centralized security and risk management platform that aggregates findings from various GCP services, not a data inspection engine. It cannot scan BigQuery table content for sensitive data directly; instead, Cloud DLP performs the inspection and sends its findings to SCC for visibility and remediation. Therefore, claiming SCC scans BigQuery automatically conflates the finding aggregator with the classification service.
- ✓
Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.
Why this is correct
Cloud Data Loss Prevention (Cloud DLP) is the correct service because it natively integrates with BigQuery to run inspection jobs on tables and columns, using over 150 built-in infoTypes (e.g., credit card numbers, email addresses, government IDs) plus custom infoTypes for organization-specific data. Scheduled inspection jobs enable continuous governance monitoring, ensuring new sensitive data is detected as it is added. DLP also offers de-identification transforms—such as masking, tokenization, and encryption—to protect the identified sensitive data, making it the only option that directly scans and classifies data content at scale.
- ✗
Cloud Monitoring custom dashboards with SQL queries that search for PII patterns.
Why it's wrong here
Cloud Monitoring custom dashboards are designed to track operational metrics such as latency, errors, and resource utilization, not to inspect data stored in BigQuery. Writing SQL queries that search for PII patterns would require executing those queries over every table, which is inefficient, non-scalable, and lacks the comprehensive infoType coverage that Cloud DLP provides. Cloud Monitoring is not a data security solution, and this approach would miss sensitive data outside the exact patterns you manually define.
- ✗
Cloud Audit Logs — they record all BigQuery queries and can identify when sensitive columns are accessed.
Why it's wrong here
Cloud Audit Logs record who accessed which BigQuery resources and when, but they do not inspect the actual data content within the tables. While an audit log entry might show that a specific user ran a query against a column, it cannot tell you whether that column contains PII or other sensitive patterns. To identify where sensitive data resides, you need a data classification tool like Cloud DLP, not just access logs.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
BigQuery
BigQuery is a fully managed, serverless data warehouse on Google Cloud that lets you run fast SQL queries on massive datasets without managing any infrastructure.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.