What's changed: Created Professional Cloud Security Engineer Chapter 3 (Domain 3 "Data protection": Sensitive Data Protection (PII discovery/redaction/pseudonymization/FPE), restricting BigQuery/Cloud Storage/Cloud SQL, Secret Manager, instance metadata protection; default encryption/CMEK/Cloud EKM, software/hardware keys (Cloud HSM), key rotation/revocation/import, object lifecycle, Confidential Computing; AI/ML security, IaaS/PaaS training models, Vertex AI security controls (VPC Service Controls/PSC/CMEK)).
3.1Sensitive data protection and data loss prevention
Understand Sensitive Data Protection (SDP) for PII discovery/redaction, pseudonymization, and format-preserving encryption; restricting access to Google Cloud data services (BigQuery, Cloud Storage, Cloud SQL); securing secrets with Secret Manager; and protecting/managing compute instance metadata.
Data protection starts with "know where sensitive data lives and redact it as needed." Find PII and minimize exposure with masking or pseudonymization.
3.1.1Sensitive Data Protection and handling sensitive data
Discover, classify, and redact sensitive data with Sensitive Data Protection (SDP, formerly Cloud DLP). Discover PII (personally identifiable information) and PHI (protected health information) via discovery (infoTypes detect credit-card numbers, emails, etc.), apply redaction (masking/removal), pseudonymization (tokenization), and format-preserving encryption (FPE—encrypt while keeping the original length/format). Restrict access to data services (BigQuery, Cloud Storage, Cloud SQL) with IAM plus VPC Service Controls. Map "discover/mask sensitive data = Sensitive Data Protection" and "encrypt keeping original format = format-preserving encryption (FPE)."
3.1.2Securing secrets and metadata
Store secrets (API keys, passwords) in Secret Manager, minimizing references via IAM with versioning and rotation (never hardcode in code/env vars). Compute instance metadata can expose sensitive info, so disable unneeded legacy metadata endpoints and tighten service-account scopes. Map "safe secret storage = Secret Manager" and "prevent metadata leakage = disable legacy metadata."
Common: requirement → means. E.g., "auto-detect and mask PII in data" = Sensitive Data Protection; "encrypt while keeping length/format" = format-preserving encryption (FPE); "replace with non-re-identifiable tokens for analysis" = pseudonymization (tokenization); "store API keys/passwords safely" = Secret Manager; "prevent leakage via metadata" = disable legacy metadata.
Watch the mix-ups: (1) Sensitive Data Protection (discover/redact sensitive data) vs Secret Manager (store secrets) target different things. (2) Choose pseudonymization (tokenization, reversible/irreversible) vs plain masking (irreversible hiding) by requirement. (3) Never hardcode secrets in code/env vars—use Secret Manager.
3.1.3Section summary
- Discover/redact/pseudonymize/FPE = Sensitive Data Protection; restrict data services with IAM + VPC Service Controls
- Secrets = Secret Manager (no hardcoding, rotate)
- Reduce instance-metadata exposure = disable legacy metadata, tighten SA scopes
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To auto-detect and mask PII (credit-card numbers, emails) across many tables/files, which is best?
Q2. To encrypt data while keeping the original length/format (e.g., 16-digit card) for downstream compatibility, which is best?
Q3. To store/reference/rotate app API keys and DB passwords safely without embedding them in code, which is best?
Q4. To share data with analysts in a non-re-identifiable form by replacing each value with a consistent token, which technique?
Q5. To reduce information exposure via compute instance metadata, which is the best measure?