GCP Professional Cloud Security Engineer Practice Question

Redaction is the transformation that removes the matched sensitive data from the payload entirely-typically replacing it with an empty string or a user-supplied replacement. Because the partner must not see any part of the card or SSN values and re-identification will never be required, redaction is the most appropriate choice. Masking would leave the length of the value visible, tokenization would create reversible surrogates, and format-preserving encryption would still allow the ciphertext to be decrypted later, so none of those meet the requirement of complete removal.