Question

A healthcare analytics company loads patient survey exports into a BigQuery dataset. The compliance team must discover which columns contain sensitive information such as U.S. Social Security numbers and email addresses before granting analysts access. They want an automated, low-code approach that produces a report of what sensitive data was found and where, without modifying the source data. Which Sensitive Data Protection (Cloud DLP) capability should they use?

Accepted Answer

Run a Sensitive Data Protection inspection job against the BigQuery table using built-in infoType detectors and write the findings to a results table or Security Command Center.

Answer

Apply a de-identification template with format-preserving encryption to tokenize every column in the dataset.

Answer

Enable Cloud KMS CMEK on the BigQuery dataset so sensitive columns are automatically encrypted at rest.

Answer

Create a VPC Service Controls perimeter around BigQuery to prevent analysts from exporting sensitive columns.