GCP Professional Cloud Security Engineer Practice Question

Your company stores payment transactions in a BigQuery table that contains customers credit-card numbers. Security requires that: (1) every card number is automatically replaced with a format-preserving token before anyone queries it; (2) analysts may read all other columns but must never see raw card data; (3) a marketing vendor working in a separate Google Cloud project must receive only daily sales aggregates and never gain access to underlying tables. Which approach meets all requirements with the least ongoing operational effort?

  • Apply column-level security to mask the credit-card column and let analysts and the vendor query the same dataset directly.

  • Export the table nightly to Cloud Storage, use a Dataflow pipeline to redact credit cards, reload the result into a new table, and share that table with analysts and the vendor.

  • Encrypt the table with a customer-managed key and use row-level security to remove the credit-card column, then deliver aggregated CSV exports to the vendor through signed URLs.

  • Run a Sensitive Data Protection inspection-transformation job that writes a tokenized copy of the table to an analytics dataset; grant analysts BigQuery Data Viewer on that dataset; create an authorized view with aggregate queries and share only the view with the vendor's project.

GCP Professional Cloud Security Engineer
Ensuring data protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Bash, the Crucial Exams Chat Bot
AI Bot