GCP Professional Data Engineer Practice Question

A payment-processing company ingests transaction records from multiple branches into a BigQuery table. Each record contains the cardholder's full name and the 16-digit primary account number (PAN).
Compliance requires the following before data can be queried by data scientists in the analytics project:

Names must be pseudonymized in a way that lets datasets from different branches still be joined on the same customer.
PANs must be rendered non-reversible, but analysts need the last four digits for charge-back investigations.
You are designing a Dataflow pipeline that calls Cloud Data Loss Prevention (DLP) for in-stream de-identification. Which approach best meets both requirements while minimizing the risk of re-identification?

Encrypt the entire table with Cloud KMS at rest and allow analysts to decrypt on read; rely on Data Catalog column tags to warn users about personal data.
Apply a CryptoDeterministicConfig transform to the name field using a shared Cloud KMS key, and apply a CharacterMaskConfig that masks the first 12 digits of the PAN, leaving the last 4 digits visible.
Store the raw table in a restricted project and grant analysts a BigQuery view that excludes the name and PAN columns; do not perform any in-pipeline transformation.
Apply a CryptoReplaceFfxFpeConfig transform to the name field and to the PAN field using the same Cloud KMS key so that both values remain reversible for auditors.

Report Issue

Answer Description

Deterministic cryptographic transformation with a centrally-managed Cloud KMS key converts identical names to the same surrogate value across all branches, so joins are still possible and the process can be reversed only by a team that controls the key.
Character masking that replaces the first 12 digits of the PAN with a fixed symbol irreversibly removes sensitive data yet keeps the last four digits available to analysts.
The other proposals either (1) use format-preserving encryption that is still reversible by anyone with a key, (2) encrypt data in bulk without selectively exposing the last four digits, or (3) rely only on access controls without actually de-identifying the data, and therefore do not satisfy the stated compliance goals.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.