Professional Cloud Security EngineerEnsuring data protectionHard
A financial services company needs to process large datasets containing credit card numbers and social security numbers in BigQuery. Before these datasets are stored or analyzed, all sensitive PII must be de-identified using a format-preserving encryption (FPE) technique, ensuring that the de-identified data retains its original format (e.g., credit card numbers remain 16 digits) but is irreversible without the specific encryption key. Which Google Cloud Data Loss Prevention (DLP) de-identification method is most suitable for this requirement?
- AReplacement with a fixed value
- BCryptoReplaceFfxFpe
- CRedaction
- DInfoType transformation
Show answer & explanationAnswer & explanation
Correct answer: B. CryptoReplaceFfxFpe
CryptoReplaceFfxFpe (Format-Preserving Encryption with FFX mode) is specifically designed to replace sensitive data with an encrypted value that maintains the original format, such as the number of digits in a credit card number. This method is irreversible without the key, making it suitable for strong de-identification while preserving data utility for analysis.
Why the other options are wrong
- A. Replacement with a fixed value replaces sensitive data with a static string, losing uniqueness and original format.
- C. Redaction removes the sensitive data entirely or replaces it with a placeholder of different format, not preserving the original format.
- D. InfoType transformation is a general term for actions taken on identified infoTypes; it doesn't specify the FPE method itself.
DLP CryptoReplaceFfxFpe
A Google Cloud DLP de-identification method that uses format-preserving encryption (FFX mode) to replace sensitive data with an encrypted value that retains the original data's format and character set.
- Preserves data format (e.g., length, character type).
- Irreversible without the encryption key.
- Useful for maintaining data utility in analytics while de-identifying.
Memory trick: FPE masks data but keeps its shape, like a secret code.