PCSE Practice Test 27 — 15 Questions

Question 1

A company has deployed an application in Assured Workloads with the FEDRAMP_HIGH compliance regime. They need to ensure that Google Cloud personnel cannot access their data. Which additional control should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Google personnel access restrictions. Assured Workloads for FedRAMP High includes the option to enable Google personnel access restrictions, which blocks Google employees from accessing the customer's data. This is a key control for FedRAMP High compliance.

Answer

Enable Access Transparency logs

Answer

Enable CMEK for all services

Answer

Enable VPC Service Controls

Question 2

A company wants to encrypt data at rest in Cloud Storage using their own keys. Which Cloud service should they use to manage these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud Key Management Service (Cloud KMS) allows customers to create, rotate, and manage their own encryption keys. Cloud HSM provides hardware security module-backed keys, but Cloud KMS is the management service. Cloud DLP is for data loss prevention, and Secret Manager is for storing secrets like API keys.

Answer

Cloud Data Loss Prevention (Cloud DLP)

Answer

Secret Manager

Answer

Cloud HSM

Question 3

A company handles Controlled Unclassified Information (CUI) and needs to deploy a workload that complies with ITAR (International Traffic in Arms Regulations). They plan to use Assured Workloads. Which compliance regime should they select when creating the Assured Workloads folder?

Accepted Answer

ITAR. For ITAR compliance, the correct regime is 'ITAR'. Assured Workloads supports multiple regimes including FedRAMP, HIPAA, and ITAR. Selecting ITAR enforces controls like personnel access restrictions and data location.

Answer

FEDRAMP_HIGH

Answer

CJIS

Answer

IL4

Question 4

A company uses Assured Workloads with the FEDRAMP_HIGH regime. They want to enforce resource location restrictions and restrict Google personnel access. Which TWO capabilities should they enable? (Choose two.)

Accepted Answer

Data residency restrictions in the Assured Workloads folder.. Assured Workloads provides data residency controls to ensure resources are deployed in specific regions, and it offers Google personnel access restrictions to limit support access to authorized personnel. Access Transparency logs actions but does not restrict. VPC Service Controls are separate from Assured Workloads. Cloud KMS is for key management.

Answer

VPC Service Controls.

Answer

Access Transparency logs.

Answer

Cloud KMS to manage encryption keys.

Question 5

A multinational company is using Assured Workloads to meet EU_Regions_and_Support compliance. They need to ensure that only EU-based Google personnel can access the customer's data for support purposes. Which configuration should they enable?

Accepted Answer

Turn on 'Access Approvals' and set personnel restrictions to EU.. Within Assured Workloads, the 'Google personnel access restrictions' option restricts support access to Google personnel located in specific regions. For EU regimes, this is set to EU. VPC Service Controls prevent data exfiltration but do not control personnel access. Access Transparency logs show actions, but do not restrict them. Data residency restrictions keep data in specific regions but do not limit Google personnel access.

Answer

Configure Access Transparency and log all support actions.

Answer

Enable VPC Service Controls to restrict data movement.

Answer

Apply data residency restrictions in the Assured Workloads folder.

Question 6

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the Cardholder Data Environment (CDE) is isolated from other resources and that only authorized services can communicate with it. Which combination of controls should they implement?

Accepted Answer

Implement VPC Service Controls to define a perimeter around the CDE, and use VPC firewall rules to restrict traffic. VPC Service Controls create a security perimeter around the CDE, preventing data exfiltration. VPC firewalls control network traffic, and Cloud Armor provides WAF protection. Together, they meet PCI DSS isolation and security requirements.

Answer

Enable Cloud NAT for outbound internet access from the CDE

Answer

Use Shared VPC with a single network for all environments

Answer

Use Cloud Armor as the only security measure

Question 7

A company subject to EU GDPR must implement the right to erasure (right to be forgotten) for personal data stored in BigQuery audit logs. The logs include query text that may contain personally identifiable information (PII). What is the correct approach to anonymize or delete PII from BigQuery audit logs?

Accepted Answer

Use Cloud DLP to scan and redact PII in the log entries as they are generated, and store redacted logs in BigQuery.. Cloud DLP can inspect and redact PII in BigQuery tables, enabling compliance with erasure requests while maintaining audit records.

Answer

Use Cloud Logging's exclusion filter to prevent PII from being logged in the first place.

Answer

Enable BigQuery table snapshot and restore to a point before the data was logged.

Answer

Delete the entire BigQuery dataset containing audit logs when a deletion request is received.

Question 8

Which Google Cloud service can automatically classify and de-identify sensitive data such as credit card numbers and health records before it is stored in Cloud Storage?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP). Cloud Data Loss Prevention (DLP) is a service that inspects content for sensitive data types (e.g., credit card numbers, PHI) and can de-identify (mask, tokenize, etc.) that data. Cloud KMS manages encryption keys, Cloud Audit Logs records activities, and Cloud Asset Inventory tracks resources.

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Asset Inventory

Question 9

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

Accepted Answer

Assured Workloads. Assured Workloads includes Access Transparency and Access Approval controls to restrict Google personnel access. When creating an Assured Workload with ITAR regime, these controls are enabled by default.

Answer

IAM Conditions

Answer

VPC Service Controls

Answer

Cloud HSM

Question 10

A data subject requests the deletion of their personal data from a Google Cloud project under GDPR. This data is stored in BigQuery audit logs that are retained for 30 days by default. What is the correct approach to fulfill this request?

Accepted Answer

Configure a log sink to exclude the data subject's audit logs and delete the existing logs by deleting the dataset that stores them.. BigQuery audit logs are immutable and cannot be modified or deleted individually. The right to be forgotten under GDPR requires deletion of personal data. The only way to comply is to delete the entire log entries or the dataset. Since the logs are retained for 30 days, you must either delete the specific logs by using a log sink to filter and exclude, or you can delete the entire dataset. However, the simplest approach is to delete the logs after they are no longer needed, but you cannot delete specific rows from BigQuery audit logs. The correct approach is to delete the dataset containing the logs if the logs are no longer needed for compliance; otherwise, you must exclude the data subject's information from future logs and delete existing ones via log routing.

Answer

Use the BigQuery DELETE statement to remove the specific rows containing the data subject's information.

Answer

Submit a request to Google Cloud Support to remove the personal data from the logs.

Answer

Use a Data Loss Prevention (DLP) job to redact the personal data from the audit logs.

Question 11

A company wants to ensure that data stored in Cloud Storage is encrypted at rest using keys that they generate and manage on-premises. Which encryption method should they use?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow you to provide your own encryption keys for Cloud Storage objects. Google discards the key after encryption/decryption, and you manage the key lifecycle.

Answer

Customer-Managed Encryption Keys (CMEK) using Cloud KMS

Answer

Google-managed encryption keys

Answer

Client-side encryption before uploading

Question 12

Which of the following is a customer responsibility under the Google Cloud shared responsibility model?

Accepted Answer

Encryption of data at rest and in transit. The shared responsibility model assigns physical security, hardware, and hypervisor security to Google; the customer is responsible for data encryption, IAM, network controls, and application security.

Answer

Physical security of data centers

Answer

Hardware maintenance

Answer

Hypervisor security

Question 13

A company needs to implement data pseudonymisation to comply with GDPR. They are using BigQuery for analytics. Which TWO services can help them pseudonymise data in transit before it enters BigQuery?

Accepted Answer

Cloud Dataflow. Cloud DLP can inspect and de-identify data, including pseudonymisation (e.g., tokenization, masking). Dataflow can process streaming data and apply transformations using DLP templates. Together, they can pseudonymise data before loading into BigQuery.

Answer

Cloud Storage

Answer

Cloud SQL

Answer

Cloud Functions

Question 14

A multinational company must comply with GDPR and needs to ensure that personal data is processed in a manner that respects data subject rights. Which TWO of the following are required under GDPR? (Choose 2)

Accepted Answer

Provide data subjects with a copy of their personal data upon request (right of access).. Right of access and privacy by design are explicit GDPR requirements. Other options are either too prescriptive or incorrect.

Answer

Delete personal data immediately upon request without any exceptions.

Answer

Store personal data only in the region where the data subject resides.

Answer

Encrypt all personal data at rest and in transit using AES-256 and TLS 1.3.

Question 15

A healthcare organization needs to ensure that all access to ePHI in Cloud SQL is logged for HIPAA compliance. They have enabled audit logs. What additional step is required to ensure logs are retained for at least one year?

Accepted Answer

Create a log sink to export the logs to Cloud Storage.. Cloud Audit Logs are retained by default for 30 days (or 400 days for some logs with the default retention in the _Required bucket). To retain logs for longer, you must create a log sink that exports logs to Cloud Storage (or BigQuery). Enabling Access Transparency logs is good but not necessary for retention. Adjusting the retention period in the Logs Explorer is not possible; Logs Explorer only queries logs within the retention period.

Answer

Enable Access Transparency logs.

Answer

Set a retention policy on the Cloud SQL instance.

Answer

Adjust the retention period in the Logs Explorer to 1 year.