Google PCA Design for security and compliance Practice Question
An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?
⚠ Common exam trap
Watch out — candidates often confuse Cloud DLP's de-identification capabilities with simple encryption or access control, assuming that encrypting connections (Cloud SQL Proxy) or restricting IAM roles (Cloud SQL Viewer) protects data at rest from privileged users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.
Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement column-level encryption using Cloud KMS in the application layer.
Why it's wrong here
This requires significant application changes and does not leverage built-in DLP capabilities.
- ✗
Grant DBAs the Cloud SQL Viewer role to restrict access to data.
Why it's wrong here
The Viewer role allows viewing data; it does not mask sensitive columns.
- ✗
Use Cloud SQL Proxy to encrypt connections and limit DBA access.
Why it's wrong here
Cloud SQL Proxy provides encrypted connections but does not mask data from DBAs.
- ✓
Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.
Why this is correct
Cloud DLP can automatically detect and tokenize sensitive data, with re-identification for authorized apps.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Schema
A schema is a blueprint or logical structure that defines how data is organized, stored, and accessed in a database or information system.
Key term
View
A view is a saved query in a database that acts like a virtual table, letting you see specific data without storing it separately.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.