PCSE Practice Test 29 — 15 Questions

Question 1

A company needs to retain critical financial records for 7 years to comply with SEC regulations. They choose to store the records in Cloud Storage. Which feature should they enable to ensure the records cannot be deleted or overwritten before the retention period expires?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a retention policy and lock the bucket using Bucket Lock.. Object Retention Lock in Cloud Storage allows you to set a retention policy on a bucket, which uses a WORM (Write Once Read Many) model. Once an object is stored, it cannot be deleted or overwritten until the retention period expires. Bucket Lock locks the retention policy, preventing changes. IAM conditions and lifecycle rules do not enforce immutability.

Answer

Enable bucket-level IAM conditions.

Answer

Configure an object lifecycle rule to delete objects after 7 years.

Answer

Use Cloud KMS to encrypt objects and destroy the key after 7 years.

Question 2

A company needs to ensure that all data stored in Cloud Storage is encrypted at rest using keys that they generate and manage themselves. They also need to rotate the keys every 90 days. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. CMEK gives customers control over key lifecycle, including automatic rotation every 90 days.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Google-managed encryption keys (GMEK)

Question 3

A healthcare organization is migrating workloads to Google Cloud and needs to process Protected Health Information (PHI) under HIPAA. Which step is required before storing PHI in any GCP service?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google Cloud. HIPAA requires a Business Associate Agreement (BAA) with Google Cloud before processing or storing PHI. The organization must sign a BAA with Google, which provides assurances regarding the protection of PHI.

Answer

Enable VPC Service Controls on all projects

Answer

Configure Cloud DLP to classify all data

Answer

Enable Cloud Audit Logs for all services

Question 4

An organization wants to run a penetration test on their Google Cloud environment to validate security controls. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Customers can conduct penetration testing without prior approval, but must avoid DoS attacks.. Google's Acceptable Use Policy allows customers to conduct penetration testing on their own infrastructure without prior approval for most services, but they prohibit denial of service (DoS) testing. Tests must follow the policy guidelines. No prior approval is needed, but DoS testing is forbidden.

Answer

Denial of Service (DoS) testing is permitted as long as it targets only customer-owned IPs.

Answer

All penetration tests require prior approval from Google Cloud support.

Answer

Penetration testing is only allowed on Compute Engine, not on managed services like Cloud SQL.

Question 5

A company processes healthcare data and has signed a BAA with Google Cloud. They need to implement controls for HIPAA compliance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Provide security awareness training to all workforce members.. HIPAA requires workforce training, access logging for covered services, and data classification to identify PHI. CMEK is optional; Cloud Armor is for web application security but not specifically required by HIPAA.

Answer

Enable Customer-Managed Encryption Keys (CMEK) for all services.

Answer

Use Cloud Armor to protect the web application from DDoS attacks.

Question 6

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud does not require prior approval for penetration testing of most services, but Denial of Service (DoS) testing is explicitly prohibited.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.

Question 7

A security team wants to monitor for compliance drift in an Assured Workloads folder that enforces FedRAMP High controls. Which Google Cloud service should they use to detect violations of organization policies?

Accepted Answer

Security Command Center. Security Command Center includes a compliance dashboard and can detect policy violations in Assured Workloads.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

Cloud Audit Logs

Question 8

A healthcare organization is migrating PHI workloads to Google Cloud and needs to encrypt data at rest with keys that are generated and managed within their own on-premises hardware security module (HSM). Which encryption approach should they use?

Accepted Answer

Enable Cloud External Key Manager (Cloud EKM).. Cloud External Key Manager (Cloud EKM) allows you to manage encryption keys in an external key management system that is FIPS 140-2 Level 3 validated, including on-premises HSMs. CSEK requires you to supply your own keys but Google manages them on the server side. CMEK uses Cloud KMS keys, which can be generated in Cloud HSM, but the keys remain under Google's control. AES-256 encryption is the default Google-managed encryption, which does not meet the requirement for customer-managed keys on an on-premises HSM.

Answer

Apply default Google-managed AES-256 encryption.

Answer

Use Cloud Key Management Service (Cloud KMS) with Cloud HSM to generate keys.

Answer

Use customer-supplied encryption keys (CSEK).

Question 9

A company is implementing a HIPAA-compliant environment on Google Cloud. They need to ensure that all access to protected health information (PHI) is logged and monitored. Which TWO steps should they take? (Choose two.)

Accepted Answer

Set up Cloud Logging-based alerts for suspicious access patterns.. HIPAA requires logging of access to PHI. Enabling Cloud Audit Logs for covered services and using Cloud Logging to monitor and set alerts on access patterns are key steps. VPC Service Controls restrict data movement but do not log access. Cloud DLP is for data classification, not logging. Cloud NAT provides outbound internet access, which is not related to logging.

Answer

Use Cloud DLP to automatically classify PHI in logs.

Answer

Configure VPC Service Controls to restrict PHI data egress.

Answer

Deploy Cloud NAT for outbound traffic from PHI instances.

Question 10

A company needs to comply with the General Data Protection Regulation (GDPR). They are using BigQuery to store personal data. Which THREE measures should they implement to meet GDPR requirements?

Accepted Answer

Enable audit logs via Cloud Audit Logs to track access to personal data.. Cloud Audit Logs provide a comprehensive, immutable record of all administrative and data access activities in BigQuery, which is essential for demonstrating GDPR compliance through accountability and traceability. By enabling audit logs, the company can track who accessed personal data, when, and from where, fulfilling the GDPR requirement to maintain records of processing activities.

Answer

Use Cloud KMS to encrypt individual columns containing personal data.

Answer

Store data in a multi-region location like 'EU' to ensure availability across regions.

Question 11

A healthcare organization is designing a data pipeline that ingests patient health records into Cloud Storage, then processes them with Dataflow for analytics. They must ensure that data is encrypted at rest and in transit, and that only authorized users can access the raw data. They also need to guarantee that the encryption keys are stored outside of Google Cloud. Which solution meets all requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with a partner key manager.. Cloud EKM allows you to manage encryption keys using a supported external key management partner, ensuring keys are stored outside Google Cloud. This meets the requirement for encryption at rest and in transit (Dataflow and Cloud Storage use these keys transparently) while keeping key material external to Google's infrastructure. Only authorized users can access raw data via IAM and the external key manager's access controls.

Answer

Use default encryption and rely on Google's data residency commitments.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for Cloud Storage and Dataflow.

Answer

Use Cloud HSM to generate and store keys.

Question 12

A company is migrating workloads to Google Cloud and wants to ensure that their VPC network is secure by default. Which two best practices should they follow? (Choose two.)

Accepted Answer

Remove the default firewall rules that allow all egress. The default VPC firewall rules include an egress rule that allows all outbound traffic (target: all instances, action: allow, protocol: all, destination: 0.0.0.0/0). Removing this default egress rule and replacing it with more restrictive outbound rules is a security best practice to prevent unauthorized data exfiltration and limit outbound connections to only necessary destinations. This aligns with the principle of least privilege for network traffic.

Answer

Use Shared VPC for all projects

Answer

Create a firewall rule to deny all ingress except specific ports

Answer

Enable VPC Flow Logs

Question 13

A company is using BigQuery to store analytics data and wants to ensure that data is retained for exactly 365 days after ingestion, then automatically deleted. How can they achieve this with minimal operational overhead?

Accepted Answer

Set the table expiration to 365 days using the ALTER TABLE SET OPTIONS statement. BigQuery datasets have a default table expiration setting, but for individual tables, you can set an expiration time. The most efficient way is to set the table expiration to 365 days, which auto-deletes the table after that period.

Answer

Use Cloud Storage Object Lifecycle rules on the data exported to Cloud Storage

Answer

Create a Cloud Function to delete tables older than 365 days

Answer

Configure a BigQuery scheduled query to delete rows older than 365 days

Question 14

An organization wants to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled. Which policy can be used to achieve this?

Accepted Answer

Organization policy with constraint `constraints/storage.uniformBucketLevelAccess`. The Organization Policy with the constraint `constraints/storage.uniformBucketLevelAccess` is a native Google Cloud policy that can be applied at the organization, folder, or project level to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled. This policy prevents the creation of buckets with fine-grained ACLs, ensuring consistent access control across the organization.

Answer

Audit logs to detect non-compliance

Answer

VPC Service Controls perimeter

Answer

IAM custom role with permission to enforce uniform access

Question 15

An organization wants to enforce that all Compute Engine instances have Confidential Computing enabled for sensitive workloads. Which TWO steps should be taken? (Choose 2)

Accepted Answer

Select machine series that support AMD Secure Encrypted Virtualization (SEV).. To enforce Confidential Computing, use an organization policy constraint to require the feature. Additionally, instance templates can be configured with Confidential Computing, but the enforcement is via policy. Also, ensuring the VM images support SEV is important. However, the key steps: 1) Set organization policy to require `compute.requireConfidentialComputing` (or similar) and 2) Use machine series that support Confidential Computing (e.g., N2D). But the question asks for two steps. The options: creating a constraint and using appropriate machine types.

Answer

Enable VPC Flow Logs for all subnets.

Answer

Use Cloud IDS to detect non-confidential instances.

Answer

Use a hierarchical firewall policy to block non-confidential instances.