Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company is concerned that employees might accidentally or maliciously upload sensitive personal data (such as credit card numbers or Social Security Numbers) to Cloud Storage buckets. Which Google Cloud product can automatically scan uploaded files and identify sensitive data patterns?
⚠ Common exam trap
Many candidates confuse a security monitoring or perimeter defense service (Cloud Armor, Security Command Center) with a content-aware data classification service (Cloud DLP), leading candidates to pick a service that audits permissions or logs events rather than one that inspects file contents for sensitive patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection
Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to inspect and classify sensitive data within Cloud Storage objects. It uses built-in detectors (infoTypes) to identify patterns like credit card numbers (Luhn check) and Social Security Numbers, and can trigger automated actions such as redaction or logging when sensitive data is found.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Armor, which inspects incoming HTTP requests for sensitive data patterns
Why it's wrong here
Cloud Armor is a DDoS protection and web application firewall (WAF) service that filters HTTP/HTTPS traffic at the edge of Google's network. It inspects the content of incoming requests — headers, cookies, and bodies — for web-based attack signatures like SQL injection and cross-site scripting, not for sensitive data patterns stored in objects within Cloud Storage. It operates only on traffic that passes through Cloud Load Balancing, so it cannot scan files that are already present in a bucket or are uploaded via other means (e.g., gcloud, client libraries). Thus, it is incorrect because it never reads object payloads at rest.
- ✓
Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection
Why this is correct
Cloud DLP is the correct answer. It has 150+ built-in infoTypes for detecting sensitive data patterns (credit card numbers matching Luhn algorithm, SSN format detection, etc.) and can scan Cloud Storage objects on a scheduled or triggered basis, flagging or de-identifying findings.
- ✗
Cloud Logging, which records all file upload events to Cloud Storage
Why it's wrong here
Cloud Logging is an operational data store that ingests, stores, and analyzes log data from Google Cloud services. For Cloud Storage, it records audit logs capturing metadata such as time, user, source IP, and event type (e.g., object creation, deletion, read), but it does not open the object to inspect its contents. Sensitive data like a credit card number or SSN exists only in the object's bytes, which Cloud Logging never receives or parses. It is therefore a governance/compliance record, not a data-loss-prevention scanner, and cannot detect or flag sensitive patterns.
- ✗
Security Command Center, which audits Cloud Storage bucket permissions
Why it's wrong here
Security Command Center (SCC) is a centralized security and risk management platform that detects misconfigurations, vulnerabilities, and threats across your GCP assets. It does audit Cloud Storage bucket IAM policies, public access grants, encryption settings, and other configuration controls, but it lacks the ability to inspect the content of objects stored inside those buckets. SCC can ingest findings from other services, including Cloud DLP, but the actual content scanning for sensitive data is done by DLP, not SCC. Hence, SCC only checks how a bucket is set up, not what data it holds.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Cloud DLP
Cloud DLP (Data Loss Prevention) is a set of tools and policies that protect sensitive data stored, processed, or shared in cloud services from unauthorized access, leaks, or breaches.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.