Question

A financial services company runs a custom microservice on Compute Engine that ingests free-text customer support messages before writing them to a database. The security team wants to inspect each message for sensitive data (such as credit card numbers and national ID numbers) in near real time, block or mask the finding before persistence, and avoid staging the raw data in Cloud Storage or BigQuery first. Which Sensitive Data Protection (DLP) approach best meets these requirements?

Accepted Answer

Call the DLP content.inspect and content.deidentify API methods synchronously from the microservice, passing each message payload directly for inline inspection and masking before writing to the database.

Answer

Schedule a recurring Cloud Storage inspection job that scans the database exports each night and generates findings in Security Command Center.

Answer

Create a BigQuery inspection job that profiles the destination table columns and applies column-level data profiles automatically.

Answer

Configure a discovery scan configuration at the organization level to continuously profile all BigQuery datasets and Cloud Storage buckets.