PCSE Practice Test 28 — 15 Questions

Question 1

A company needs to retain audit logs for 7 years to meet compliance requirements. By default, Cloud Audit Logs are retained for 30 days. What should they do to retain the logs for 7 years?

Accepted Answer

Create a log sink to export audit logs to a Cloud Storage bucket with a retention policy set to 7 years.. Log Sinks can route logs to Cloud Storage Buckets, which support retention policies. Object Retention Lock can enforce WORM compliance if required.

Answer

Increase the default audit log retention period in the Logging settings to 7 years.

Answer

Enable Logging export to BigQuery and set table expiration to 7 years.

Answer

Use Cloud Functions to copy audit logs daily to Coldline Storage.

Question 2

A government contractor needs to deploy a workload on Google Cloud that complies with FedRAMP High and ITAR (International Traffic in Arms Regulations). They require that Google personnel cannot access the infrastructure and that data residency is restricted to the United States. Which Google Cloud solution should they use?

Accepted Answer

Assured Workloads with the FEDRAMP_HIGH and ITAR compliance regimes, and enable Google personnel access restrictions.. Assured Workloads provides a consolidated compliance framework that includes FedRAMP, ITAR, and access restrictions.

Answer

VPC Service Controls with Organization Policies restricting resource location to the US.

Answer

Cloud HSM with Customer-Managed Encryption Keys (CMEK) stored in a US key region.

Answer

Deploy the workload in a Google Cloud region only available to US government customers (us-gov-west1).

Question 3

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted at rest using a customer-managed key that is automatically rotated every 90 days. What should they do?

Accepted Answer

Create a Cloud KMS key ring and a key with rotation period set to 7776000s (90 days).. Cloud KMS allows you to create a customer-managed encryption key (CMEK) with an automatic rotation period of 7776000 seconds (90 days). When you set the rotation period on a key, Cloud KMS automatically rotates the key material at the specified interval, ensuring that all data encrypted with that key is protected by a new key version without manual intervention. This satisfies the requirement for customer-managed keys with automatic rotation.

Answer

Use customer-supplied encryption keys (CSEK) and update them manually every 90 days.

Answer

Use default Google-managed encryption keys.

Answer

Use Cloud HSM to generate a key and implement a custom rotation script.

Question 4

An organization is using Assured Workloads to enforce ITAR compliance. They need to ensure that all resources are deployed in specific US regions and that Google personnel access is restricted. They also want to monitor for any configuration changes that violate compliance policies. Which service should they use for monitoring compliance drift?

Accepted Answer

Assured Workloads compliance monitoring. Assured Workloads provides a compliance monitoring feature that alerts on policy violations, including resource location and access restrictions. Cloud Monitoring is for performance metrics, Cloud Asset Inventory tracks resources, and Security Command Center provides threat detection but not specific compliance drift monitoring for Assured Workloads.

Answer

Cloud Asset Inventory

Answer

Security Command Center

Answer

Cloud Monitoring

Question 5

A security engineer needs to run a penetration test against their Google Cloud environment. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval for most services, but DoS attacks are prohibited.. Google's policy allows customers to conduct penetration tests against their own infrastructure without prior approval for most services, provided the tests do not involve denial of service (DoS) attacks. DoS testing is explicitly prohibited without prior written approval. Testing other customers' resources is never allowed.

Answer

Penetration testing is not allowed against any Google Cloud resources.

Answer

Denial of Service (DoS) testing is allowed with prior notification to Google.

Answer

All penetration tests require prior approval from Google Cloud Support.

Question 6

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) in Cloud Storage. They have signed a Business Associate Agreement (BAA) with Google. Which additional step is REQUIRED to ensure HIPAA compliance for the data stored?

Accepted Answer

No additional action is required; Cloud Storage is HIPAA-eligible and encrypts data at rest by default.. HIPAA requires encryption of PHI at rest. Cloud Storage automatically encrypts data at rest using Google-managed keys. Customers can optionally use CMEK, but CMEK is not required. Enabling Object Versioning is not a HIPAA requirement. Configuring a VPC is a network control, not a specific HIPAA requirement for storage.

Answer

Use Customer-Managed Encryption Keys (CMEK) for the bucket.

Answer

Configure the bucket to be in a VPC with no public access.

Answer

Enable Object Versioning on the bucket.

Question 7

A security engineer needs to audit changes to IAM policies across their Google Cloud organization. Which audit log type should they enable to capture IAM policy changes?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture all API calls that modify configuration, including IAM policy changes.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

Access Transparency logs

Question 8

Which Google Cloud service provides the ability to enforce data retention policies on Cloud Storage objects to prevent deletion or modification for a specified duration?

Accepted Answer

Cloud Storage Object Retention Lock. Object Retention Lock uses retention policies and legal holds to comply with WORM requirements.

Answer

Cloud Storage Bucket Lock

Answer

VPC Service Controls

Answer

Cloud Storage Object Lifecycle Management

Question 9

A company is subject to PCI DSS and needs to protect a web application that processes credit card data. They want to block common web attacks such as SQL injection and cross-site scripting (XSS). Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is a Web Application Firewall (WAF) that provides protections against OWASP Top 10 threats like SQL injection and XSS. It integrates with Cloud Load Balancing to filter traffic.

Answer

Cloud NAT

Answer

Cloud CDN

Answer

Identity-Aware Proxy (IAP)

Question 10

A multinational corporation uses Google Cloud and must comply with GDPR. They want to process personal data for a new purpose that was not originally disclosed to data subjects. What is the correct course of action under GDPR?

Accepted Answer

Obtain explicit consent from the data subjects for the new processing purpose.. GDPR requires a valid legal basis for each processing purpose. For a new purpose, explicit consent is often required unless another basis applies.

Answer

Anonymize the data before processing, as anonymized data is not subject to GDPR.

Answer

Rely on the existing DPA with Google, as it covers all processing activities.

Answer

Proceed with the new processing as long as the data is pseudonymized.

Question 11

A government contractor needs to deploy workloads on GCP that meet FedRAMP High baseline requirements. They want to enforce resource location restrictions and access controls for Google personnel. Which product should they use?

Accepted Answer

Assured Workloads. Assured Workloads provides compliance-focused folders that enforce location restrictions, personnel access controls, and other controls specific to the chosen regime (e.g., FedRAMP High).

Answer

Cloud Security Command Center

Answer

VPC Service Controls

Answer

Organization Policies

Question 12

A company is using Assured Workloads with the FEDRAMP_HIGH regime. They need to restrict where resources can be created and monitor for compliance violations. Which TWO settings should they configure? (Choose 2)

Accepted Answer

Resource location restrictions. Resource location restrictions limit the regions where resources can be deployed. Compliance monitoring (or compliance drift monitoring) alerts when resources violate policies. Google personnel access restrictions control internal access, and Access Transparency logs provide logs. Data residency is similar to resource location.

Answer

Access Transparency logs

Answer

Data residency controls

Answer

Google personnel access restrictions

Question 13

A company that stores protected health information (PHI) in Google Cloud wants to run a BigQuery query to identify and classify sensitive data such as patient names and social security numbers. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP). Cloud Data Loss Prevention (Cloud DLP) is specifically designed to inspect, classify, and de-identify sensitive data. It can be used to scan BigQuery tables and other data sources for PHI, PII, and other sensitive content. Cloud Audit Logs track access, BigQuery itself does not classify data, and Cloud KMS manages encryption keys.

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (Cloud KMS)

Answer

BigQuery's built-in data classification

Question 14

An organization must comply with ITAR regulations. They use Assured Workloads with the ITAR regime. Which THREE controls are automatically enforced by this regime? (Choose three.)

Accepted Answer

Use of Customer-Managed Encryption Keys (CMEK) for applicable services. Assured Workloads for ITAR enforces data residency, personnel access restrictions, and encryption with CMEK. VPC Service Controls, while important, are not automatically enforced by the regime itself but can be added separately.

Answer

VPC Service Controls automatically configured

Answer

Cloud Audit Logs retention set to 10 years

Question 15

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) while maintaining HIPAA compliance. They have executed a Business Associate Agreement (BAA) with Google. Which additional step is required to ensure that PHI is properly classified and protected?

Accepted Answer

Use Cloud Data Loss Prevention (DLP) to inspect and classify storage buckets containing PHI.. For HIPAA compliance, after signing a BAA, organizations must implement data classification. Cloud DLP provides the ability to discover and classify PHI across GCP services.

Answer

Enable Audit Logs for all services that process PHI.

Answer

Configure Cloud Armor to protect web applications handling PHI.

Answer

Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.