PCSE Practice Test 33 — 15 Questions

Question 1

A healthcare organization is migrating to Google Cloud and needs to ensure that all data stored in Cloud Storage is encrypted at rest with customer-managed encryption keys (CMEK) to meet HIPAA requirements. The security team wants to centrally manage key rotation and access. Which solution should they implement?

Accepted Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK and enable key rotation.. Option C is correct because Cloud KMS with CMEK allows the organization to centrally manage encryption keys, including automated key rotation, while maintaining customer control over the keys used to encrypt Cloud Storage data. This meets HIPAA requirements for encryption at rest with customer-managed keys, as Cloud KMS integrates directly with Cloud Storage to enforce encryption using the specified key.

Answer

Use Cloud Data Loss Prevention (DLP) to de-identify data before storing.

Answer

Use Cloud Hardware Security Module (Cloud HSM) with CMEK.

Answer

Use customer-supplied encryption keys (CSEK) stored in Cloud Storage.

Question 2

A company is deploying a new application that will process credit card data and must comply with PCI DSS. They plan to use Google Cloud services. Which service should they use to detect and redact sensitive data stored in Cloud Storage buckets?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and redact sensitive data such as credit card numbers (PANs) in Cloud Storage buckets. It uses built-in infoType detectors (e.g., `CREDIT_CARD_NUMBER`) to identify PCI DSS-protected data and can automatically apply de-identification transformations like redaction or masking to comply with PCI DSS requirements.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud Audit Logs

Question 3

A government contractor uses Google Cloud with Assured Workloads. They need to ensure that data stored in BigQuery is encrypted with keys generated and stored in a Cloud HSM key ring located in a specific region. The keys must be rotated every 90 days. Which approach meets these requirements?

Accepted Answer

Create a Cloud HSM key ring in the desired region, create a key with a rotation period of 90 days, and use that key to protect the BigQuery dataset via CMEK.. Option A is correct because it uses a Cloud HSM key ring in the desired region, which meets the requirement for hardware-backed key generation and storage. Setting a rotation period of 90 days on the key satisfies the rotation requirement, and using that key as a customer-managed encryption key (CMEK) for BigQuery ensures data is encrypted with the specified key.

Answer

Use Cloud KMS with a software key and enable automatic rotation of 90 days.

Answer

Create a Cloud HSM key ring and manually rotate keys every 90 days.

Answer

Use Cloud External Key Manager (EKM) with an external key management partner.

Question 4

A financial institution is required to use customer-managed encryption keys (CMEK) for all data at rest in Google Cloud. They need to prevent key deletion by anyone except a specific IAM role. What should they do?

Accepted Answer

Enable destroy protection on the key ring. Option A is correct because enabling destroy protection on the key ring prevents any Cloud KMS key within that key ring from being destroyed, regardless of IAM permissions. This is a key ring-level setting that overrides IAM roles, ensuring that only a specific IAM role (e.g., cloudkms.admin) can disable destroy protection and then delete keys, meeting the requirement to restrict key deletion to a specific role.

Answer

Use Organization Policies with a constraint to restrict key destruction

Answer

Assign the cloudkms.admin role only to a security team

Answer

Enable key rotation on the Cloud KMS key

Question 5

A company uses Forseti Security to monitor their GCP environment for compliance violations. They want to automatically enforce policies that prevent the deployment of resources without required labels. What should they do?

Accepted Answer

Use Forseti Config Validator with a deny policy that blocks creation of resources without required labels. Forseti Config Validator can enforce policies at deployment time by using a deny policy that blocks resource creation if required labels are missing. This is the correct approach because it prevents non-compliant resources from being created in the first place, rather than detecting and remediating them after the fact.

Answer

Configure Forseti Inventory to scan and report resources missing labels, then manually delete them

Answer

Enable VPC Service Controls to restrict projects without labels from accessing resources

Answer

Use Cloud Asset Inventory to trigger Cloud Functions that delete resources missing labels

Question 6

A financial institution must meet SOX compliance requirements for audit trail integrity. Which THREE measures should they implement to ensure Cloud Audit Logs are immutable and securely stored?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS for audit logs.. Option B is correct because using customer-managed encryption keys (CMEK) with Cloud KMS ensures that audit logs are encrypted with keys under the customer's control, preventing unauthorized decryption even by Google. This satisfies SOX requirements for data integrity and confidentiality, as the logs cannot be tampered with or accessed without the key.

Answer

Use VPC Service Controls to prevent exfiltration of logs.

Answer

Set up Cloud IAM roles to restrict who can read audit logs.

Question 7

To comply with regulatory requirements, a company needs to prevent service account keys from being created for all projects. What should they use?

Accepted Answer

Organization policy with a constraint. Organization policies with constraints allow you to enforce restrictions across all projects in an organization. The `constraints/iam.disableServiceAccountKeyCreation` constraint specifically prevents the creation of service account keys, ensuring compliance with regulatory requirements that prohibit long-lived keys. This is a native Google Cloud IAM feature that applies at the organization, folder, or project level.

Answer

VPC Service Controls

Answer

Security Command Center

Answer

IAM conditions

Question 8

Refer to the exhibit. A compliance officer is reviewing an Access Transparency log entry. Which compliance benefit does this log provide?

Accepted Answer

It provides evidence of data access by Google engineers. Access Transparency logs are specifically designed to provide visibility into actions performed by Google personnel (e.g., engineers) on customer data. This log entry shows an operation by a Google support engineer, which directly supports compliance requirements by providing evidence of data access by Google engineers, as required for regulatory audits like SOC 2 or FedRAMP.

Answer

It shows a user accessing a storage object

Answer

It tracks encryption key usage

Answer

It is a Cloud Audit Log for admin activity

Question 9

A healthcare company subject to HIPAA must prevent data exfiltration from Google Cloud storage buckets. They already use VPC Service Controls. Which additional control should they configure to directly block unauthorized copying of data to external projects?

Accepted Answer

Configure egress rules in the VPC Service Controls perimeter. VPC Service Controls allow you to define perimeters that restrict data movement between authorized and unauthorized projects. By configuring egress rules within the perimeter, you can explicitly block copying data to external projects, directly preventing data exfiltration. This is the correct additional control because it enforces policy at the network boundary, not just at the application or storage layer.

Answer

Enable Cloud Data Loss Prevention (DLP) scanning

Answer

Use Cloud Audit Logs to review access

Answer

Apply Cloud Identity-Aware Proxy (IAP) to buckets

Question 10

A security engineer notices that some developers are still uploading their own public SSH keys to Compute Engine instances despite the organization policy above being applied to the folder. What is the most likely reason?

Accepted Answer

The policy disables uploading service account keys, not user SSH keys.. Option C is correct because the organization policy described likely restricts the uploading of service account keys, not user SSH keys. The policy in question is typically the 'Disable service account key upload' constraint (iam.disableServiceAccountKeyUpload), which prevents users from creating or uploading external service account keys. It does not affect the ability to add public SSH keys to Compute Engine instances, which is governed by separate metadata-based mechanisms (e.g., oslogin or instance metadata). Therefore, developers can still upload their own SSH keys despite the policy being applied.

Answer

The policy only applies to projects, not folders.

Answer

The policy takes 24 hours to propagate to all projects.

Answer

The policy was applied at the organization level, not the folder level.

Question 11

For PCI DSS compliance, which of the following is required for Cloud KMS keys?

Accepted Answer

Enable automatic rotation with a rotation period set to 90 days. PCI DSS requirement 3.5.1 mandates that cryptographic keys must be rotated at least every 90 days to limit the impact of a potential key compromise. For Cloud KMS, enabling automatic rotation with a rotation period of 90 days ensures compliance by automating the key rotation process without manual intervention, reducing the risk of human error.

Answer

Use a separate key per service account

Answer

Disable key rotation after initial use

Answer

Key rotation every 30 days

Question 12

Refer to the exhibit. A compliance officer sees this Organization Policy applied at the organization level. Which compliance requirement does this policy primarily address?

Accepted Answer

Data residency. The Organization Policy shown restricts the allowed locations for Compute Engine resources to a specific region (e.g., us-central1). This directly enforces data residency requirements by preventing resources from being created or moved outside of approved geographic boundaries, ensuring that data remains within a particular jurisdiction to comply with regulations like GDPR or HIPAA.

Answer

Encryption key management

Answer

Audit logging

Answer

Access control

Question 13

A healthcare organization is migrating to Google Cloud and needs to achieve HIPAA compliance. Which THREE actions are required to meet HIPAA requirements on GCP? (Choose THREE.)

Accepted Answer

Enable Cloud Audit Logs for all services handling ePHI. Option A is correct because enabling Cloud Audit Logs for all services handling ePHI is a direct requirement under HIPAA's Security Rule (45 CFR § 164.312(b)), which mandates audit controls to record and examine activity in systems that contain or use electronic protected health information. Cloud Audit Logs provide immutable, tamper-evident logs of admin activities, data access, and system events, which are essential for demonstrating compliance during audits or breach investigations. Without these logs, the organization cannot meet the audit control standard for ePHI environments on GCP.

Answer

Enable VPC Flow Logs for all subnets

Answer

Use Cloud NAT for outbound internet access

Question 14

A compliance officer reviews the Cloud Audit Log entry above and wants to know if any sensitive data was exposed during the instance creation. What is the best course of action?

Accepted Answer

Enable data access audit logs for Compute Engine to capture request payloads.. Option A is correct because enabling data access audit logs for Compute Engine captures the request payloads of API calls, including the instance creation request. This allows the compliance officer to inspect the exact parameters sent, such as any sensitive data that might have been passed as metadata or startup scripts, which are not included in the default admin activity audit logs. Data access audit logs provide the granularity needed to determine if sensitive data was exposed during the operation.

Answer

Check the status field to see if the operation failed, which might indicate a misconfiguration.

Answer

Analyze the log entry to see the image used; the image metadata is included.

Answer

Use Cloud DLP to scan the log entry for sensitive data.

Question 15

A pharmaceutical company uses Google Cloud to process clinical trial data subject to HIPAA. They must ensure that only authorized applications can access the data, even if credentials are compromised. Which security control should they implement?

Accepted Answer

Use service account impersonation with IAM conditions to restrict access to specific trusted applications.. Option B is correct because service account impersonation with IAM conditions allows the company to bind access to specific trusted applications by requiring that the caller present a specific service account identity. Even if credentials are compromised, the attacker cannot impersonate that service account unless they also satisfy the IAM conditions (e.g., resource tags, IP ranges, or application identity). This directly addresses the requirement to restrict access to authorized applications only, as per HIPAA's minimum necessary standard.

Answer

Use Workload Identity Federation to allow workloads to access data without service account keys.

Answer

Create a VPC Service Control perimeter that allows only specific service accounts to access the data.

Answer

Require users to MFA and use IAM roles to grant access.