PCSE Practice Test 23 — 15 Questions

Question 1

A security engineer wants to automatically rotate a database password stored in Secret Manager every 30 days. The new password should be generated and stored in Secret Manager without manual intervention. Which approach meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a rotation period in Secret Manager, set a Pub/Sub topic, and implement a Cloud Function that listens for rotation messages to generate and add a new secret version.. Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Answer

Set up a Cloud Lifecycle rule to delete the old secret version and create a new one with the same value.

Answer

Use a Cloud KMS key to re-encrypt the secret each month.

Answer

Use gcloud secrets versions add with a scheduled Cloud Scheduler job that generates a new password and adds it as a new version.

Question 2

Which two statements correctly describe Cloud KMS key versions? (Choose TWO.)

Accepted Answer

Key versions are immutable once created.. Key versions in Cloud KMS are immutable and each has its own key material. You can enable or disable versions for rotation. A key has multiple versions; rotation creates new versions. The state can be ENABLED, DISABLED, DESTROYED, etc. The grace period applies to destruction scheduling.

Answer

Key versions can be rotated automatically without creating a new version.

Answer

The destruction of a key version is immediate upon request.

Answer

Each key version can have a different purpose.

Question 3

A financial services company must encrypt data at rest in Cloud Storage using keys that are generated and stored on-premises, and Google must never have access to the key material. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). CSEK (Customer-Supplied Encryption Keys) allows you to provide your own keys with each API call, and Google does not store them. This meets the requirement that Google never has access to key material.

Answer

Cloud External Key Manager (EKM) with a key management partner

Answer

Default Google-managed encryption (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS

Question 4

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted using keys that they manage and rotate on a schedule they control. The keys must be stored in a FIPS 140-2 Level 3 validated HSM. Which encryption approach should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud HSM. Customer-Managed Encryption Keys (CMEK) combined with Cloud HSM allow customers to manage their own keys in a FIPS 140-2 Level 3 validated HSM. Google-managed keys do not give customer control, and Customer-Supplied Encryption Keys (CSEK) require the customer to supply the key with each API call and Google does not store the key, which is impractical for many use cases and does not use HSM.

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys (GMEK)

Question 5

A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.. Secret Manager can set a rotation period and publish a Pub/Sub message upon rotation. A Cloud Function can subscribe to that topic and execute updates. Directly triggering from Secret Manager is not possible. Cloud Scheduler is not needed.

Answer

Manually rotate the secret and set a Cloud Scheduler job to invoke the Cloud Function.

Answer

Use Cloud Scheduler to call the Secret Manager API to add a new version every 60 days, then trigger a Cloud Function via HTTP.

Answer

Set a rotation period on the secret and directly specify a Cloud Function as a webhook in Secret Manager.

Question 6

A company uses Cloud HSM to protect their cryptographic keys. They need to ensure that the key material never leaves the HSM. Which key purpose is supported by Cloud HSM keys?

Accepted Answer

All key purposes (ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, MAC). Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. HSM keys can have purposes ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, and MAC. The key material remains inside the HSM cluster and is never exposed to the customer. Software keys (software-backed) are stored in Cloud KMS but not in HSM.

Answer

Only symmetric ENCRYPT_DECRYPT

Answer

Only MAC purpose

Answer

Only asymmetric purposes

Question 7

A company needs to store sensitive API keys in Secret Manager and ensure that only a specific service account can access the latest version of a secret. Which IAM permission is required for the service account to read the secret value?

Accepted Answer

secretmanager.versions.access. To access a secret version's payload (the actual secret value), the permission 'secretmanager.versions.access' is required. The role 'roles/secretmanager.secretAccessor' includes this permission. The other permissions are for listing or managing metadata.

Answer

secretmanager.secrets.get

Answer

secretmanager.secrets.create

Answer

secretmanager.versions.list

Question 8

A healthcare organization must ensure that Protected Health Information (PHI) stored in Cloud Storage buckets is not inadvertently shared. They want to automatically scan all new objects added to the bucket for sensitive data and log findings. Which approach should they use?

Accepted Answer

Use Cloud DLP inspection job triggers with a schedule to scan the bucket periodically.. Cloud DLP job triggers can be configured to scan Cloud Storage buckets on a schedule or event-driven (e.g., via Cloud Storage Pub/Sub notifications). The trigger will inspect objects for sensitive data and log results. This meets the requirement for automatic scanning.

Answer

Use Data Loss Prevention (DLP) API to manually scan the bucket each time a new object is added.

Answer

Use Access Transparency logs to monitor all access to the bucket.

Answer

Use Cloud Audit Logs and create a log-based metric to detect sensitive data.

Question 9

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) such as credit card numbers and social security numbers. The scanning must be performed on a schedule (every week). Which GCP service and resource should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) with a DLP job trigger. Cloud DLP can inspect data for sensitive info types. DLP job triggers allow scheduling recurring scans of Cloud Storage, BigQuery, or Datastore. The trigger runs the inspection job based on a schedule.

Answer

Cloud Security Command Center (SCC)

Answer

Cloud Asset Inventory

Answer

Cloud Audit Logs

Question 10

A company uses CMEK with Cloud HSM to encrypt a BigQuery table. The security engineer accidentally deleted the key in Cloud KMS. The key is now in a 'pending destruction' state with a grace period of 24 hours. Which action should the engineer take to restore the key and avoid data loss?

Accepted Answer

Restore the key by canceling the destruction within the grace period. When a key is destroyed, it enters a pending destruction state for a default 24-hour grace period. During this period, the key can be restored by cancelling the destruction. After the grace period, the key is permanently destroyed and data encrypted with it becomes inaccessible. The restore operation is available in Cloud KMS.

Answer

Recreate the key with the same name and version

Answer

Wait for the grace period to expire and then use a backup key

Answer

Use Access Transparency logs to recover the key material

Question 11

Which Cloud KMS key purpose should be used to encrypt and decrypt data directly?

Accepted Answer

ENCRYPT_DECRYPT. The ENCRYPT_DECRYPT purpose is for symmetric encryption/decryption. ASYMMETRIC_SIGN is for digital signing, ASYMMETRIC_DECRYPT is for asymmetric decryption (e.g., using RSA), and MAC is for message authentication codes.

Answer

ASYMMETRIC_DECRYPT

Answer

ASYMMETRIC_SIGN

Answer

MAC

Question 12

An organization needs to comply with ITAR regulations. They want to ensure that all data processed by their GCP resources remains within the United States. Which service should they use?

Accepted Answer

Assured Workloads. Assured Workloads provides regulatory compliance controls, including support for ITAR. It helps enforce data residency and access controls required for ITAR workloads.

Answer

VPC Service Controls

Answer

Cloud DLP

Answer

Organization policy constraint gcp.resourceLocations

Question 13

What is the default grace period before Cloud KMS permanently destroys a key version that has been scheduled for destruction?

Accepted Answer

24 hours. When a key version is disabled and scheduled for destruction, there is a 24-hour pending destruction grace period by default. During this time, the key can be restored. After 24 hours, the key version is permanently destroyed.

Answer

7 days

Answer

Immediate destruction with no grace period

Answer

30 days

Question 14

A company wants to enforce that all Compute Engine disk encryption uses keys managed by their own HSM on-premises, with keys provided per API call. Which encryption type should they choose when creating a persistent disk?

Accepted Answer

Customer-supplied encryption (CSEK). CSEK (Customer-Supplied Encryption Keys) allows you to provide your own key with each API call, and Google never stores the key. This is appropriate for on-premises HSM integration.

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM-backed keys

Answer

Customer-managed encryption (CMEK) with Cloud KMS

Question 15

A company is subject to ITAR regulations and needs to ensure that all data stored in GCP remains within the United States. They also require FIPS 140-2 Level 3 validation for encryption keys. Which two services should they use together to meet these requirements? (Choose 2)

Accepted Answer

Cloud HSM. Assured Workloads provides compliance controls for ITAR (among others) and can enforce data residency within the US. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for encryption keys. Together they satisfy both requirements.

Answer

Cloud KMS with software keys

Answer

Cloud DLP

Answer

Secret Manager