De-identifying PII in Cloud Storage with DLP for Secure ML Exploration

PMLE By islever Editorial Last updated

Exploring and preprocessing data for ML. Identifying risks to AI solutions.

Short answer

A Use the Cloud Data Loss Prevention (DLP) API to de-identify the PII before performing data exploration and preprocessing.

Question

You are analyzing customer data for a healthcare organization that is stored in Cloud Storage. The data contains personally identifiable information (PII). You need to perform data exploration and preprocessing while ensuring the security and privacy of sensitive fields. What should you do?
  1. Use the Cloud Data Loss Prevention (DLP) API to de-identify the PII before performing data exploration and preprocessing. Correct Answer
  2. Use customer-managed encryption keys (CMEK) to encrypt the PII data at rest, and decrypt the PII data during data exploration and preprocessing.
  3. Use a VM inside a VPC Service Controls security perimeter to perform data exploration and preprocessing.
  4. Use Google-managed encryption keys to encrypt the PII data at rest, and decrypt the PII data during data exploration and preprocessing.

Key Takeaways

Encryption protects data at rest but not during active processing; de-identification via DLP removes sensitivity before analysis, preventing exposure.

This page explains how to securely explore healthcare PII in Cloud Storage by using the Cloud DLP API to de-identify sensitive data before preprocessing, ensuring privacy compliance.

Common mistake: Choosing encryption options like CMEK (B or D) is common, but these only protect data at rest and require decryption for exploration, leaving PII exposed during the critical analysis phase.

Expert Analysis

The question requires performing data exploration and preprocessing on PII stored in Cloud Storage while ensuring privacy. The key constraint is protecting sensitive fields during the analysis phase, not just at rest.

Option A is correct because the Cloud Data Loss Prevention (DLP) API can de-identify PII by redacting, masking, or tokenizing sensitive values. De-identification transforms the data so that it no longer contains direct identifiers, allowing safe exploration without exposing actual patient data. This aligns with privacy-by-design principles where risk is minimized by removing sensitivity before processing.

Option B is incorrect because using Customer-Managed Encryption Keys (CMEK) only protects data at rest. To explore the data, it must be decrypted, which exposes the raw PII to the compute environment and potential attackers during the preprocessing step. Decryption does not prevent leakage during active use.

Option C is incorrect because VPC Service Controls creates a security perimeter to prevent data exfiltration from Google Cloud services. While it adds network-level security, it does not inherently protect the content of the data being processed inside a VM. If the VM has access to the data, the PII is still visible to anyone with access to that VM or its logs, failing the specific requirement to secure the fields themselves.

Option D is incorrect for similar reasons as B. Google-managed encryption keys also only protect data at rest. Decrypting the data for exploration leaves the PII exposed during the analysis process, creating a window of vulnerability.

Exam Strategy

When questions ask about securing data 'during' processing or 'exploration', prioritize methods that alter or mask the data content itself (like de-identification or pseudonymization) rather than infrastructure protections (like encryption or VPC SC) that only secure storage or transit. Look for keywords like 'de-identify', 'mask', or 'tokenize' when 'privacy during use' is emphasized.

Frequently Asked Questions

Why isn't encryption enough for data exploration?

Encryption protects data at rest and in transit. To analyze data, it must be decrypted, making the raw PII visible to the compute resources. De-identification removes the sensitive elements entirely before this step.

Does VPC Service Controls protect PII content?

No. VPC Service Controls prevents unauthorized data exfiltration from Google Cloud projects. It does not hide or mask the content of data accessed by authorized users within the perimeter.

More PMLE FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. fitri001 👍 4 Answered A
    Cloud DLP API: This service redacts or replaces sensitive information in your data before processing. It allows data exploration and analysis without exposing PII directly. Privacy Preservation: De-identification ensures sensitive information is not revealed during analysis, protecting patient privacy.
  2. pikachu007 👍 2 Answered A
    Minimizes exposure of sensitive data: De-identification replaces or removes sensitive information, reducing the risk of accidental exposure or unauthorized access during analysis. Preserves data utility: DLP can de-identify data while maintaining its usefulness for exploration and preprocessing, ensuring meaningful analysis without compromising privacy. Flexibility in de-identification: You can choose appropriate de-identification techniques (e.g., masking, pseudonymization, generalization) based on specific privacy requirements and analysis needs.
  3. fitri001 👍 2
    B. CMEK and decryption: While CMEKs provide strong encryption, decrypting PII data during exploration exposes sensitive information. This increases the risk of accidental leaks or unauthorized access. C. VM with VPC Service Controls: This approach can add complexity and doesn't directly address PII privacy concerns during analysis. D. Google-managed encryption and decryption: Similar to option B, decrypting PII data for exploration weakens privacy.
  4. taylz876 👍 1 Answered A
    fields private. The best approach is to remove the exposure at the source: the DLP API finds the PII and de-identifies it (masking, tokenizing or encrypting the sensitive values) before anyone works with the data. You can then explore and preprocess the de-identified version freely. The service is now called Sensitive Data Protection, but its API is still the Cloud DLP API, so you may see either name. Why the others are wrong • B and D: Encrypting data at rest, with customer-managed keys or Google-managed keys, protects against someone stealing the stored files. But you then decrypt the data to explore it, so the PII is fully visible to whoever is doing the analysis. Cloud Storage already encrypts at rest by default, so these add nothing for this problem. • C: A VPC Service Controls perimeter helps stop data leaving your project (exfiltration), but it doesn't hide the PII from the people and tools inside the perimeter.
  5. b1a8fae 👍 1 Answered A
    A. https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify
Show 2 more comments
  1. pinimichele01 👍 1 Answered A
    https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify
  2. edoo 👍 1 Answered A
    A is obvious.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Monitoring ML Model Performance with Precision and Recall Sampling

S-grade

Optimizing ML Model Recall for Compliance Risk

S-grade

How to Minimize Development Time for Weekly TensorFlow Retraining in Vertex AI?

S-grade

Building CLV Models with BigQuery ML in Vertex AI Workbench

S-grade

Practice All PMLE Questions

Access 65 questions with complete answers and detailed explanations.

View Full PMLE Practice Test →

← Back to PMLE Study Guide