mediumMultiple SelectObjective-mapped
PCSE Practice Question: Using Cloud Data Loss Prevention (DLP) to inspect…
A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?
⚠ Common exam trap
Google Cloud often tests the misconception that VPC Service Controls or Cloud KMS are directly involved in the DLP inspection and de-identification process, when in fact they are separate security services for perimeter control and key management, respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the DLP API to inspect the storage for sensitive data.
The DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create custom infoTypes for all sensitive data.
Why it's wrong here
DLP provides many built-in infoTypes; custom infoTypes are not always necessary.
- ✓
Use the DLP API to inspect the storage for sensitive data.
Why this is correct
DLP API can scan and classify data using infoTypes.
- ✓
Apply de-identification transformations such as masking or tokenization.
Why this is correct
DLP supports various de-identification techniques.
- ✗
Store de-identification templates in Cloud KMS.
Why it's wrong here
De-identification templates are stored in DLP, not Cloud KMS.
- ✗
Use VPC Service Controls to restrict access to the data.
Why it's wrong here
VPC Service Controls do not classify or de-identify data.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.