PDE Maintaining and Automating Data Workloads Practice Question
You need to inspect a BigQuery table for sensitive data such as credit card numbers and apply masking. Which GCP service should you use to identify and de-identify the data?
⚠ Common exam trap
PDE often tests the confusion between governance/orchestration services (Dataplex) and the actual detection-and-de-identification engine (Cloud DLP), so candidates pick Dataplex when the task is specifically identifying and masking sensitive data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Data Loss Prevention (DLP)
Cloud Data Loss Prevention (DLP) is Google Cloud's service for discovering, classifying, and de-identifying sensitive data such as credit card numbers, SSNs, and emails. It provides infoType detectors (including CREDIT_CARD_NUMBER) and de-identification transforms like masking, tokenization, and format-preserving encryption. It integrates directly with BigQuery for scanning tables and applying masking at query or storage time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM Recommender
Why it's wrong here
IAM Recommender analyses role usage and suggests permission reductions; it neither scans table contents for card-number patterns nor transforms values. It suits tightening over-privileged service accounts. Sensitive-data discovery and masking require Sensitive Data Protection (DLP), which inspects and de-identifies BigQuery columns.
- ✗
Cloud KMS
Why it's wrong here
Cloud KMS manages encryption keys and performs cryptographic operations on data at rest; it cannot recognise card-number patterns or redact fields. It suits envelope encryption of storage and databases. Pattern-based inspection and masking require Sensitive Data Protection (DLP), which scans and de-identifies BigQuery content.
- ✗
Dataplex
Why it's wrong here
Dataplex governs data lakes through zones, cataloguing and quality tasks; it does not itself detect card-number patterns or apply masking transformations to BigQuery values. It suits metadata and lineage management across assets. Inspection and de-identification belong to Sensitive Data Protection (DLP).
- ✓
Cloud Data Loss Prevention (DLP)
Why this is correct
Cloud Data Loss Prevention scans BigQuery tables using built-in infoTypes to detect credit card numbers, then applies de-identification transforms such as masking, tokenisation or redaction directly on the findings. This satisfies the stem's requirement to both identify sensitive data and mask it within BigQuery.
Go deeper
Related to this question
About these practice questions
This PDE question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PDE exam.