How to secure PII during data exploration?

PMLE By islever Editorial Last updated

Short answer

A Use the Cloud Data Loss Prevention (DLP) API to de-identify the PII before performing data exploration and preprocessing.

Question

You are analyzing customer data for a healthcare organization that is stored in Cloud Storage. The data contains personally identifiable information (PII). You need to perform data exploration and preprocessing while ensuring the security and privacy of sensitive fields. What should you do?
  1. Use the Cloud Data Loss Prevention (DLP) API to de-identify the PII before performing data exploration and preprocessing. Correct Answer
  2. Use customer-managed encryption keys (CMEK) to encrypt the PII data at rest, and decrypt the PII data during data exploration and preprocessing.
  3. Use a VM inside a VPC Service Controls security perimeter to perform data exploration and preprocessing.
  4. Use Google-managed encryption keys to encrypt the PII data at rest, and decrypt the PII data during data exploration and preprocessing.

Key Takeaways

The question tests the distinction between data protection via encryption versus de-identification, with the common trap being selecting encryption options that expose raw PII during processing.

Use the Cloud Data Loss Prevention (DLP) API to de-identify PII before analysis to protect sensitive data. Community consensus confirms that de-identification is the best method to ensure privacy during data exploration.

Common mistake: Selecting CMEK or Google-managed encryption (Options B or D) is incorrect because encryption protects data at rest but requires decryption for processing, exposing PII to the analyst.

Expert Analysis

Why the Answer Is Correct

The Cloud Data Loss Prevention (DLP) API provides de-identification techniques like masking, redaction, or tokenization. Applying this before exploration ensures that sensitive fields are never visible to the analyst or the processing logic. This strictly adheres to privacy requirements while allowing data utility.

Why the Other Options Are Wrong

Options B and D focus on encryption at rest. While secure for storage, data must be decrypted in memory to be explored or preprocessed, meaning the PII is exposed to anyone with access to the processing environment. Option C (VPC Service Controls) prevents data exfiltration but does not obscure the data content from authorized users.

Community Comment Notes

Community members strongly supported Option A, noting that DLP minimizes exposure and preserves data utility. Comments highlighted that de-identification ensures sensitive information is not revealed during analysis. This makes it the obvious choice for privacy preservation compared to encryption methods.

Official Reference

https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions involve PII and analysis, prioritize de-identification over encryption to ensure data privacy during processing. Remember that encryption protects data at rest, but de-identification protects data in use.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. fitri001 👍 3 Answered A
    Cloud DLP API: This service redacts or replaces sensitive information in your data before processing. It allows data exploration and analysis without exposing PII directly. Privacy Preservation: De-identification ensures sensitive information is not revealed during analysis, protecting patient privacy.
  2. pikachu007 👍 2 Answered A
    Minimizes exposure of sensitive data: De-identification replaces or removes sensitive information, reducing the risk of accidental exposure or unauthorized access during analysis. Preserves data utility: DLP can de-identify data while maintaining its usefulness for exploration and preprocessing, ensuring meaningful analysis without compromising privacy. Flexibility in de-identification: You can choose appropriate de-identification techniques (e.g., masking, pseudonymization, generalization) based on specific privacy requirements and analysis needs.
  3. b1a8fae 👍 1 Answered A
    A. https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify
  4. pinimichele01 👍 1 Answered A
    https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify
  5. edoo 👍 1 Answered A
    A is obvious.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Minimize Development Time for Weekly TensorFlow Retraining in Vertex AI?

S-grade

How to Handle Categorical Features in BigQuery ML for Fast Deployment?

S-grade

How to preprocess BigQuery data for TensorFlow?

S-grade

How to Track Model and Prediction Lineage in Vertex AI?

S-grade

Practice All PMLE Questions

Access 65 questions with complete answers and detailed explanations.

View Full PMLE Practice Test →

← Back to PMLE Study Guide