Objective 3.1
PCSEProtecting sensitive data and preventing data loss
Objective 3.1 sits in Ensuring data protection, which carries 23% of the Cloud Security Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.
Objective title verbatim from the official objectives. Google Cloud exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A team must de-identify account numbers for a legacy billing system that validates field length on input. Which transformation fits?
Correct.
Concept
Downstream systems often enforce a shape long before they read a meaning. A transformation that keeps the shape lets the protected value flow through validation that would reject anything else.
Why B
CryptoReplaceFfxFpeConfig replaces an input value with a token of the same length using format-preserving encryption in the FFX mode, which suits legacy systems where string length must be maintained.
Source
Google Cloud: Sensitive Data Protection transformation reference, checked August 2026CryptoReplaceFfxFpeConfig Replaces an input value with a token, or surrogate value, of the same length using format-preserving encryption (FPE) with the FFX mode of operation. This allows the output to be used in systems that have format validation on length. This is useful for legacy systems where string length must be maintained.
Now you: objective 3.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An analyst tokenizes free-text notes of varying length, some well over 32 bytes, and needs the same input to yield the same token. Which configuration applies?
Sample question 2 of 3
A team wants a redacted export where each removed value still shows which kind of sensitive data stood there. Which transformation does that?
Sample question 3 of 3
A research team de-identifies patient dates but must keep the interval between admission and discharge intact. Which transformation preserves that?
Full Cloud Security Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.