A bank drops CSV statements into a Cloud Storage bucket, and some files contain card numbers. The bank wants each new file inspected and sensitive values masked automatically as soon as it arrives. Which design does this?
Show answer and explanation
Answer: B
Object finalize events from Cloud Storage can trigger a serverless function, which calls the Cloud DLP API to inspect each newly written object and de-identify the findings. The work happens without manual steps and as files arrive. Lifecycle rules act on age and class and cannot read content, weekly manual checks leave sensitive values exposed for days, and versioning keeps the original values rather than removing them.
Why the other options are wrong
- A. Lifecycle rules act on object age or storage class and cannot evaluate what a file contains, so they cannot identify card numbers at all.
- C. A weekly manual review leaves sensitive values exposed for days and does not scale as upload volume grows, so it fails the automation requirement.
- D. Versioning keeps prior object generations, which means card numbers remain stored and are kept longer, the opposite of the masking goal.