PCSE Ensuring Data Protection Practice Question
A company uses Cloud DLP to inspect data in Cloud Storage and BigQuery for sensitive information such as credit card numbers and social security numbers. They want to de-identify the data using format-preserving encryption (FPE) so that the masked data retains the same format (e.g., a 16-digit number still looks like a credit card number). Which two configurations should they use? (Choose TWO).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A cryptographic key in Cloud KMS to be used with the FPE transform
CryptoReplaceFfxFpeConfig performs format-preserving encryption (FPE) based on the FFX mode. It can preserve the format of credit card numbers. The transform must be configured with a cryptographic key from Cloud KMS to ensure the encryption is secure. BucketingConfig replaces values with a bucket label, not FPE. MaskingConfig replaces characters with a mask character. DateShiftConfig shifts dates by a random number of days.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A de-identification template with BucketingConfig
Why it's wrong here
BucketingConfig replaces values with a bucket label, not format-preserving.
- ✓
A cryptographic key in Cloud KMS to be used with the FPE transform
Why this is correct
CryptoReplaceFfxFpeConfig requires a wrapping key in Cloud KMS to encrypt the FPE key.
- ✗
A de-identification template with DateShiftConfig
Why it's wrong here
DateShiftConfig shifts dates, not for credit card numbers.
- ✗
A de-identification template with MaskingConfig
Why it's wrong here
MaskingConfig replaces characters with a mask, not preserving format.
- ✓
A de-identification template with CryptoReplaceFfxFpeConfig
Why this is correct
CryptoReplaceFfxFpeConfig performs format-preserving pseudonymization using FPE.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.