Google PCA Design for security and compliance Practice Question
An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?
⚠ Common exam trap
Many candidates choose Cloud Dataflow (option A) thinking it is required for large-scale DLP processing, but the question specifies 'uploaded to a specific bucket' which implies per-file, event-driven processing where Cloud Functions is the simpler and correct serverless choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud DLP
Cloud DLP (option C) is correct because it provides native content inspection and de-identification (redaction) of sensitive data like credit card numbers using built-in infoType detectors. Cloud Functions (option D) is correct because it can be triggered by Cloud Storage events (e.g., finalize/create) to invoke the DLP API on newly uploaded CSV files, enabling serverless, event-driven processing without managing infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Dataflow
Why it's wrong here
Cloud Dataflow is a managed Apache Beam runner for building streaming and batch pipelines; it provides no credit-card detection or redaction transforms of its own, so it cannot identify sensitive values. It is tempting because Dataflow processes data at scale, but the stem needs the DLP API's infoType detection combined with Cloud Storage event triggers.
- ✗
Cloud Run
Why it's wrong here
Cloud Run executes containerised HTTP services and event-driven functions, but it ships no built-in sensitive-data detection or redaction capability, so credit-card numbers would go unidentified. It is tempting because Cloud Run can be triggered by Cloud Storage object events, yet the required pairing is Cloud Storage with the DLP API.
- ✓
Cloud DLP
Why this is correct
Cloud DLP supplies the infoType detectors that identify credit card numbers and the de-identification transforms that redact them. This satisfies the detection and redaction constraint, since it recognises sensitive data patterns rather than relying on filenames or metadata.
- ✓
Cloud Functions
Why this is correct
Cloud Functions provides the event-driven compute triggered by object finalisation in the bucket, invoking the DLP API and writing redacted output. This satisfies the automation constraint, since no manual intervention is needed when CSV files land in Cloud Storage.
- ✗
BigQuery
Why it's wrong here
BigQuery is an analytics warehouse for querying and transforming data, not an inline redaction service for objects landing in Cloud Storage; it cannot intercept uploads or write redacted CSV back. It is tempting because BigQuery can query CSV files externally, but the required combination is Cloud Storage triggers with the DLP API.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Google Cloud Resource Hierarchy and Organization
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.