Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Classification of sensitive data such as credit card numbers

  Why this is correct

  Cloud DLP identifies sensitive data by applying built-in infoType detectors that match patterns like credit card numbers, which are further validated with Luhn checksum and contextual evidence. This classification step is the foundation for subsequent data protection actions, allowing organizations to discover where sensitive data resides across stored and streaming content, and even supports custom regex detectors for proprietary formats.

• ✓

  De-identification of data through masking, tokenization, and encryption

  Why this is correct

  De-identification transforms the actual content so it can be safely used in lower-security environments. Cloud DLP provides multiple methods: masking replaces characters with symbols (e.g., XXXX), tokenization replaces a value with a randomly generated token while preserving a mapping table for reversibility, and format-preserving encryption (FPE) encrypts data so the output retains the original format. These transformations can be applied and re-identified using cryptographic keys, enabling controlled data sharing and compliance with privacy regulations.

• ✗

  Network vulnerability scanning

  Why it's wrong here

  Network vulnerability scanning is an infrastructure security concern that involves probing services, ports, and system configurations for exploitable weaknesses. This is not a feature of Cloud DLP, which is scoped to content inspection and de-identification of data rather than network-level threat detection. On Google Cloud, such scanning is typically performed by Cloud Security Scanner for App Engine or by third-party vulnerability management tools, and DLP does not interact with network stacks.

• ✗

  Removal of malware from uploaded files

  Why it's wrong here

  Cloud DLP does not execute files or analyze binary signatures to detect malware, as that falls into antivirus or endpoint detection and response (EDR) product categories. Its inspection engine is designed to parse text, structured data, and common file formats (like PDFs and spreadsheets) for sensitive data patterns, not malicious code. Malware removal would require a separate solution, such as VirusTotal, Chronicle, or a custom file scanning pipeline, none of which are part of Cloud DLP's core functionality.

• ✗

  Creation of IAM policies

  Why it's wrong here

  Cloud DLP is a consumer of IAM policies but does not create them. IAM policy creation is handled by Cloud IAM, where administrators define principals, roles, and condition bindings that control access to resources like projects, buckets, and datasets. While Cloud DLP requires IAM permissions to access data and invoke services, it cannot author or modify IAM policies; its role is to inspect and protect data content, not to manage resource-level access control.

Go deeper

Related to this question