GCP Professional Cloud Security Engineer Practice Question

A healthcare provider stores daily HL7 message archives in a Cloud Storage bucket and ingests selected fields into a BigQuery dataset for analytics. Compliance requires that all protected health information (PHI) be discovered and replaced with cryptographically generated tokens that can later be re-identified for patient care. Data engineers need fresh, de-identified data every night with minimal ongoing maintenance. Which solution best satisfies these requirements while aligning with HIPAA obligations?

Enable VPC Service Controls around the project, export the datasets to on-premises, run an open-source scrubbing script, then import the sanitized files back to BigQuery each morning.
Use Object Lifecycle Management to delete the original Cloud Storage archives after 24 hours and rely on default encryption; analysts query the remaining BigQuery tables directly.
Create an inspection template for common PHI infoTypes, pair it with a de-identification template that uses CryptoDeterministicConfig protected by Cloud KMS, and schedule a Cloud DLP job trigger to process the Cloud Storage bucket and BigQuery dataset nightly, writing the transformed output to a separate analytics project.
Apply BigQuery column-level security tags to every column that might contain PHI and grant analysts only the Data Viewer role on an authorized view of the original tables.

Report Issue

Answer Description

A Cloud DLP (Sensitive Data Protection) job trigger can automatically inspect both Cloud Storage objects and BigQuery tables on a schedule. By referencing an inspection template that uses the built-in PHI infoTypes and pairing it with a de-identification template that applies CryptoDeterministicConfig (or format-preserving encryption) with a wrapped Cloud KMS key, each PHI element is replaced by a consistent surrogate value. Because the key is retained in Cloud KMS, the process is reversible when clinicians must recover the original data. Job triggers run without manual intervention, writing the transformed results to a separate BigQuery dataset or Storage location that analysts can query. The alternative options either do not perform reversible de-identification, fail to cover both storage systems, or rely on ad-hoc processes that increase operational overhead and compliance risk.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.