PCSE Ensuring Data Protection Practice Question
A company uses Cloud DLP to scan a BigQuery table for sensitive data. They want to automatically mask credit card numbers in query results for users who are not data stewards. Which approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a BigQuery Data Policy with masking rules on the column and assign appropriate IAM roles
BigQuery column-level security with data masking rules (via BigQuery Data Policy) allows defining masking policies (e.g., email masking, hash masking) that are automatically applied to query results based on user IAM. DLP inspection can identify the sensitive columns, but the masking is enforced by BigQuery policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Access Transparency to log queries and manually review
Why it's wrong here
Access Transparency logs Google admin access, not user query results. It does not mask data.
- ✗
Use Cloud DLP de-identification jobs to replace credit card numbers with tokens in the source table
Why it's wrong here
De-identification jobs modify source data, not query-time masking. This alters the original data for all users.
- ✗
Use Cloud DLP inspect job and then manually apply a view that masks the column
Why it's wrong here
Manual views are not dynamic based on user roles and require maintenance. Data policies are the recommended approach.
- ✓
Create a BigQuery Data Policy with masking rules on the column and assign appropriate IAM roles
Why this is correct
BigQuery Data Policy allows column-level masking that applies dynamically based on the user's access, without modifying the underlying data.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.