Professional Cloud ArchitectDesign for security and complianceEasy
A financial institution is migrating its core banking application to Google Cloud. They have a stringent compliance requirement to ensure that all sensitive customer data (e.g., account numbers, personally identifiable information) stored in Cloud Storage and BigQuery is automatically discovered, classified, and protected from accidental exposure or unauthorized sharing. They need a service that can scan existing data and continuously monitor new data for sensitive information. Which Google Cloud service is designed for this purpose?
- ACloud Identity and Access Management (IAM)
- BCloud Data Loss Prevention (DLP)
- CSecurity Command Center
- DCloud Audit Logs
Show answer & explanationAnswer & explanation
Correct answer: B. Cloud Data Loss Prevention (DLP)
Cloud Data Loss Prevention (DLP) is specifically designed to discover, classify, and protect sensitive data across Google Cloud services. It can scan data at rest and in transit, identify various types of sensitive information, and apply redaction or masking. IAM controls access, Security Command Center monitors security posture, and Cloud Audit Logs record activities, but none perform the core function of discovering and protecting sensitive data content like DLP.
Why the other options are wrong
- A. Cloud IAM controls 'who' has 'what' access to 'which' resources, but it does not inspect the content of data for sensitive information or protect it from loss once access is granted.
- C. Security Command Center provides security posture management and threat detection across Google Cloud, but it doesn't perform deep content inspection and protection of sensitive data like DLP.
- D. Cloud Audit Logs records administrative activities and data access events, but it does not proactively discover, classify, or protect sensitive data content.
Cloud Data Loss Prevention (DLP)
A Google Cloud service for discovering, classifying, and protecting sensitive data wherever it lives in Google Cloud.
- Detects sensitive data types (PII, financial, etc.).
- Provides de-identification, redaction, and masking capabilities.
- Integrates with various Google Cloud data stores (Cloud Storage, BigQuery).
Memory trick: DLP Scans, Classifies, Protects, No Data Loss Intercepts.