How to secure PII during data exploration?

You are analyzing customer data for a healthcare organization that is stored in Cloud Storage. The data contains personally identifiable information (PII). You need to perform data exploration and preprocessing while ensuring the security and privacy of sensitive fields. What should you do?

  1. Use the Cloud Data Loss Prevention (DLP) API to de-identify the PII before performing data exploration and preprocessing. Source Reference Answer
  2. Use customer-managed encryption keys (CMEK) to encrypt the PII data at rest, and decrypt the PII data during data exploration and preprocessing.
  3. Use a VM inside a VPC Service Controls security perimeter to perform data exploration and preprocessing.
  4. Use Google-managed encryption keys to encrypt the PII data at rest, and decrypt the PII data during data exploration and preprocessing.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the distinction between data protection via encryption versus de-identification, with the common trap being selecting encryption options that expose raw PII during processing.

Use the Cloud Data Loss Prevention (DLP) API to de-identify PII before analysis to protect sensitive data. Community consensus confirms that de-identification is the best method to ensure privacy during data exploration.

Selecting CMEK or Google-managed encryption (Options B or D) is incorrect because encryption protects data at rest but requires decryption for processing, exposing PII to the analyst.

Community Discussion (5 comments)

fitri001 👍 3 Selected: A
Cloud DLP API: This service redacts or replaces sensitive information in your data before processing. It allows data exploration and analysis without exposing PII directly. Privacy Preservation: De-identification ensures sensitive information is not revealed during analysis, protecting patient privacy.
pinimichele01 👍 1 Selected: A
https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify
edoo 👍 1 Selected: A
A is obvious.
b1a8fae 👍 1 Selected: A
A. https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify
pikachu007 👍 2 Selected: A
Minimizes exposure of sensitive data: De-identification replaces or removes sensitive information, reducing the risk of accidental exposure or unauthorized access during analysis. Preserves data utility: DLP can de-identify data while maintaining its usefulness for exploration and preprocessing, ensuring meaningful analysis without compromising privacy. Flexibility in de-identification: You can choose appropriate de-identification techniques (e.g., masking, pseudonymization, generalization) based on specific privacy requirements and analysis needs.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The Cloud Data Loss Prevention (DLP) API provides de-identification techniques like masking, redaction, or tokenization. Applying this before exploration ensures that sensitive fields are never visible to the analyst or the processing logic. This strictly adheres to privacy requirements while allowing data utility.

Why the Other Options Are Wrong

Options B and D focus on encryption at rest. While secure for storage, data must be decrypted in memory to be explored or preprocessed, meaning the PII is exposed to anyone with access to the processing environment. Option C (VPC Service Controls) prevents data exfiltration but does not obscure the data content from authorized users.

Community Comment Notes

Community members strongly supported Option A, noting that DLP minimizes exposure and preserves data utility. Comments highlighted that de-identification ensures sensitive information is not revealed during analysis. This makes it the obvious choice for privacy preservation compared to encryption methods.

Official Reference

https://cloud.google.com/dlp/docs/inspect-sensitive-text-de-identify

Exam Strategy

When questions involve PII and analysis, prioritize de-identification over encryption to ensure data privacy during processing. Remember that encryption protects data at rest, but de-identification protects data in use.

Related Analysis

You recently used XGBoost to train a model in Python that wi

S-Grade

You are building a custom image classification model and pla

A-Grade

You developed a custom model by using Vertex AI to forecast

A-Grade

Practice All PMLE Questions

Access 65 questions with complete answers and detailed explanations.

View Full PMLE Practice Test →

← Back to PMLE Study Guide