PCSE Ensuring Data Protection Practice Question
A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?
⚠ Common exam trap
Google often tests the distinction between inspection-only jobs (detection) and de-identification jobs (transformation), and the trap here is that candidates confuse 'inspection' with 'redaction' or assume a custom function is needed when DLP's native transforms suffice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
De-identification job using a masking transform for credit card numbers.
Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inspection job with a Cloud Data Loss Prevention API to call a Cloud Function.
Why it's wrong here
Inspection jobs do not transform data.
- ✗
De-identification job with a bucketing transform.
Why it's wrong here
Bucketing is for generalizing, not specifically redacting credit card numbers.
- ✗
Inspection job with a Cloud Pub/Sub notification to trigger a Cloud Function that redacts the data.
Why it's wrong here
An inspection job only finds PII; redaction requires a de-identification job or additional code.
- ✓
De-identification job using a masking transform for credit card numbers.
Why this is correct
A de-identification job can apply transforms (e.g., masking) to redact sensitive data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.