PCSE Practice Test 40 — 15 Questions

Question 1

A media company stores video assets in a Cloud Storage bucket. They want to ensure that all objects in the bucket are encrypted with a Customer-Managed Encryption Key (CMEK) rather than the default Google-managed encryption. They also need to prove to auditors that CMEK is enforced and cannot be bypassed. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an organization policy constraint with the storage.encryptionType restriction to require CMEK for all new objects.. The organization policy constraint storage.encryptionType is designed to enforce that new objects use a customer-managed encryption key. This preventive control blocks the creation of objects with Google-managed encryption, ensuring compliance and providing an auditable enforcement mechanism. Default encryption settings and uniform bucket-level access do not prevent the use of Google-managed keys, and Cloud DLP cannot enforce encryption.

Answer

Enable uniform bucket-level access on the bucket.

Answer

Configure a Cloud KMS key ring and set the default encryption key on the bucket to a CMEK.

Answer

Use Cloud DLP to scan the bucket and automatically re-encrypt any objects found without CMEK.

Question 2

A startup stores user credentials in a Cloud SQL database. They want to ensure that the database password is never hardcoded in application code and is automatically rotated every 60 days. Which Google Cloud service should they use to store and rotate the password?

Accepted Answer

Secret Manager. Secret Manager is the dedicated service for storing and rotating secrets. It provides secure storage, access control, and automatic rotation capabilities, which are exactly what the startup needs. Cloud KMS, Cloud Storage, and IAM database authentication do not offer secret storage with rotation, making them unsuitable for this scenario.

Answer

Cloud Storage with CMEK

Answer

Cloud KMS

Answer

Cloud SQL IAM database authentication

Question 3

A company has an organization policy that restricts resource locations to 'us-central1' and 'us-east1'. A developer attempts to create a Compute Engine instance in 'europe-west1' using the Compute Engine API and receives a permission denied error. The developer has the roles/compute.instanceAdmin.v1 role at the project level. What is the most likely cause?

Accepted Answer

The organization policy constraint constraints/gcp.resourceLocations is enforced and blocks the creation.. Organization policy constraints like constraints/gcp.resourceLocations can restrict where resources are created. Even with the compute.instanceAdmin.v1 role, a developer cannot create an instance in a disallowed region because the policy enforcement blocks the request. This is a common guardrail to ensure data residency and compliance. The error message may not explicitly mention the policy, but the region-specific denial points to it.

Answer

The developer lacks the compute.instances.create permission because roles/compute.instanceAdmin.v1 does not include it.

Answer

The developer needs the roles/compute.networkAdmin role to create instances in europe-west1.

Answer

The Compute Engine API is disabled for the project, preventing instance creation.

Question 4

A security engineer is configuring access for a new application running on Compute Engine. The application needs to access a Cloud SQL database and a Cloud Storage bucket. The engineer wants to avoid using service account keys and ensure the application uses the principle of least privilege. What should the engineer do?

Accepted Answer

Attach a service account with the necessary roles to the instance and let the application use the metadata server to obtain credentials.. Attaching a service account to the Compute Engine instance is the recommended way to provide credentials without keys. The application can query the metadata server for an access token. By granting the service account only the necessary roles, such as Cloud SQL Client and Storage Object Viewer, the engineer adheres to least privilege. This approach eliminates key management overhead and reduces the risk of credential leakage.

Answer

Enable Cloud SQL IAM database authentication and use the instance's service account to connect to Cloud SQL, and grant the service account Storage Object Admin for the bucket.

Answer

Use the default Compute Engine service account and grant it the Editor role to ensure it has all necessary permissions.

Answer

Create a service account with the necessary roles, download a JSON key, and store it on the instance.

Question 5

Your organization uses Google Cloud and wants to enforce that all access to Cloud Storage buckets must come from within the corporate network or from approved devices. You need to implement this using context-aware access. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Access Context Manager access levels that define trusted networks and device policies.. To enforce context-aware access to Cloud Storage, you need Access Context Manager to define access levels that specify trusted networks and device policies, and VPC Service Controls to apply those access levels to a service perimeter that includes Cloud Storage. Together, they ensure that only requests satisfying the access level can access the buckets.

Answer

Cloud Armor security policy attached to the bucket.

Answer

Cloud IAM Conditions with IP-based constraints on the bucket's IAM policy.

Answer

Identity-Aware Proxy (IAP) enabled for Cloud Storage.

Question 6

A company stores sensitive customer data in Cloud Storage buckets. They need to ensure that data is encrypted at rest with a key that they manage themselves, and that the key material is generated and stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3. They also require automatic rotation every 90 days. Which solution should they use?

Accepted Answer

Cloud KMS with an HSM key ring and automatic rotation enabled.. The requirement is for customer-managed keys that are HSM-backed and automatically rotated. Cloud KMS with an HSM key ring provides FIPS 140-2 Level 3 validated HSMs for key generation and storage, and supports automatic rotation. Software keys, EKM, and CSEK do not meet all criteria.

Answer

Cloud KMS with a software key ring and automatic rotation enabled.

Answer

Customer-supplied encryption keys (CSEK) stored in a local HSM.

Answer

Cloud External Key Manager (EKM) with a third-party key management system.

Question 7

A company uses Google Cloud and has a requirement that all access to their Google Cloud resources must be controlled by their existing third-party identity provider (IdP) using SAML 2.0. They want to ensure that only users who are members of a specific group in the IdP can access Google Cloud, and that these users must use multi-factor authentication (MFA) to sign in. They also want to minimize administrative overhead. Which two steps should the security engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enforce MFA in the third-party IdP for all users who access Google Cloud.. To control access via a third-party SAML IdP and enforce MFA, you must configure SAML SSO and map IdP groups to Google groups for IAM assignments. MFA must be enforced at the IdP because Google Cloud delegates authentication to it. This approach centralizes user management and MFA policies in the IdP, reducing administrative overhead.

Answer

Create a Google group that includes all users from the IdP and assign the roles/iam.securityReviewer role to that group at the organization level.

Answer

Enable 2-Step Verification (2SV) enforcement in Google Workspace for all users.

Answer

Use Google Cloud Directory Sync (GCDS) to synchronize the IdP group to a Google group and then use IAM Conditions to restrict access based on group membership.

Question 8

A security team is using Access Context Manager to define access levels based on IP subnets and device policies. They want to enforce that only users on a corporate network with a trusted device can access a sensitive Cloud Storage bucket via the Google Cloud Console. They have created an access level named 'corp_trusted'. What should they do next to enforce this access level for the bucket?

Accepted Answer

Create an IAM condition on the bucket's IAM policy that uses the access level as a condition for the roles/storage.objectViewer role.. Access levels are used in IAM conditions to enforce context-aware access. By adding an IAM condition that references the 'corp_trusted' access level to the bucket's IAM policy, the security team ensures that only users on the corporate network with a trusted device can access the bucket. This is the standard way to apply access levels to specific resources without affecting other resources.

Answer

Configure the bucket's default event-based hold to require the access level for object access.

Answer

Apply the access level to the organization's VPC Service Controls perimeter that includes the bucket.

Answer

Enable uniform bucket-level access and add the access level to the bucket's ACL.

Question 9

A healthcare analytics team stores patient records in Cloud Storage and BigQuery. Auditors require that sensitive fields like patient names and medical record numbers be replaced with surrogate values before analysts can query the data, but the same surrogate value must consistently map back to the original patient across all datasets so longitudinal studies remain valid. Which Cloud DLP de-identification technique should the team apply?

Accepted Answer

Crypto-based tokenization using a Cloud KMS-wrapped AES-SIV key, with surrogate values derived deterministically from the input. Deterministic crypto-based tokenization with a Cloud KMS-wrapped AES-SIV key is the only technique here that produces a stable surrogate for identical input while remaining reversible for authorized parties. Random initialization vectors, per-record date offsets, and bucketing all break the one-to-one consistency needed to link patients across Cloud Storage and BigQuery datasets. The KMS-wrapped key also keeps re-identification under cryptographic access control.

Answer

Bucketing values into fixed ranges so each record is replaced by a range label

Answer

Format-preserving encryption with a randomly generated initialization vector per record

Answer

Date shifting with a per-patient random offset applied independently to each record

Question 10

A company needs to encrypt data at rest in BigQuery using a customer-managed encryption key (CMEK) so that they can control key rotation and revocation. They want to use Cloud KMS. Which of the following must they do to use CMEK with BigQuery?

Accepted Answer

Create a Cloud KMS key in the same region as the BigQuery dataset, grant the BigQuery service account the cloudkms.cryptoKeyEncrypterDecrypter role on the key, and specify the key when creating the dataset.. To use CMEK with BigQuery, the key must reside in the same region as the dataset, the BigQuery service account must have the cloudkms.cryptoKeyEncrypterDecrypter role on that key, and the key must be provided when the dataset is created. This ensures that all data written to the dataset is encrypted with the customer-managed key from the outset, satisfying control and compliance requirements.

Answer

Create a Cloud KMS key in any region, grant the BigQuery service account the cloudkms.admin role, and specify the key when creating the dataset.

Answer

Create a Cloud KMS key in the same region as the BigQuery dataset, grant the BigQuery service account the cloudkms.cryptoKeyEncrypterDecrypter role on the key, and set the key as the default encryption key for the project using the gcloud command.

Answer

Create a Cloud KMS key in the same region as the BigQuery dataset, grant the BigQuery service account the cloudkms.cryptoKeyEncrypterDecrypter role on the key, and enable CMEK by updating the dataset with the key after creation.

Question 11

A security engineer needs to ensure that data stored in a Cloud SQL for MySQL instance is encrypted at rest with a key that the organization controls and can rotate. The organization already uses Cloud KMS. What is the simplest way to achieve this?

Accepted Answer

Configure the Cloud SQL instance to use a customer-managed encryption key (CMEK) by specifying a Cloud KMS key when creating or updating the instance.. Cloud SQL supports customer-managed encryption keys (CMEK) through Cloud KMS. By specifying a Cloud KMS key when creating or updating the instance, you ensure that data at rest is encrypted with a key you control. This allows key rotation and revocation. The Cloud SQL service account needs the cloudkms.cryptoKeyEncrypterDecrypter role on the key. This is the simplest and most direct method.

Answer

Create a Cloud KMS key and store it in a Secret Manager secret, then configure the Cloud SQL instance to use that secret as its encryption key.

Answer

Enable transparent data encryption (TDE) on the Cloud SQL instance and manage the master key in Cloud KMS.

Answer

Use a customer-supplied encryption key (CSEK) by providing a raw AES-256 key during instance creation.

Question 12

A healthcare analytics company stores patient records in Cloud Storage. Regulatory requirements mandate that all data be encrypted with customer-managed encryption keys (CMEK) and that the encryption keys be automatically rotated every 90 days. They also need the ability to revoke access to the data immediately if a key is compromised. Which Google Cloud service should they use to centrally manage and rotate these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS) with a symmetric key and a 90-day rotation schedule. Cloud KMS is the centralized key management service for creating, rotating, and revoking customer-managed encryption keys used by Cloud Storage and other Google Cloud services. A symmetric key with a 90-day rotation schedule satisfies automatic key rotation, and disabling or destroying a key version provides immediate revocation. The other services do not offer integrated CMEK management for Cloud Storage.

Answer

Cloud Identity-Aware Proxy (IAP) with encryption at rest enabled

Answer

Cloud HSM with a 90-day rotation policy

Answer

Cloud External Key Manager (Cloud EKM) with a third-party key manager

Question 13

A financial institution uses Cloud DLP to de-identify sensitive data in a BigQuery table before sharing it with an analytics team. They need to replace each email address with a surrogate value that is consistent across all rows, so that the same email always maps to the same surrogate, and the mapping cannot be reversed without additional information. Which Cloud DLP transformation should they use?

Accepted Answer

cryptoHash. cryptoHash is a Cloud DLP transformation that uses a cryptographic hash function with a secret salt to generate consistent, irreversible surrogates. The same input always produces the same output, satisfying the consistency requirement. Without the salt, reversing the hash is infeasible, so the mapping cannot be reversed without additional information. This makes it suitable for pseudonymization in analytics while protecting privacy.

Answer

cryptoReplaceFfxFpe

Answer

redact

Answer

replaceWithInfoType

Question 14

A company is using Cloud DLP to inspect and de-identify sensitive data in a Cloud Storage bucket. They need to ensure that the de-identification process is reversible for authorized users, but irreversible for others. They plan to use Cloud DLP's cryptographic transformation methods. Which two methods should they use? (Choose two.)

Accepted Answer

Format-preserving encryption (FPE) with a cryptographic key managed in Cloud KMS.. Format-preserving encryption and tokenization are both reversible de-identification methods that can be controlled so that only authorized users can reverse them. FPE uses a cryptographic key, and tokenization uses a token vault with access controls. Both allow authorized parties to recover the original data while preventing others from doing so. Hashing and redaction are irreversible, and date shifting is not cryptographic.

Answer

Date shifting, which shifts dates by a random offset.

Answer

Redaction, which removes sensitive data entirely.

Answer

Cryptographic hashing with a salt.

Question 15

Your team stores sensitive customer records in Cloud Storage. A security policy requires that all data be encrypted with customer-managed encryption keys (CMEK) and that key usage be logged for audit. You create a Cloud KMS key ring and key in the same region as the bucket. Which additional configuration must you apply to the bucket to enforce CMEK encryption for all newly written objects?

Accepted Answer

Set the bucket's default KMS key to the Cloud KMS key.. To enforce CMEK for new objects, the bucket must have a default KMS key configured. This ensures that any object written without an explicit encryption key is encrypted with the specified Cloud KMS key. While IAM permissions on the key are required, they do not automatically apply the key to the bucket. Other settings like uniform bucket-level access or organization policies do not set a default encryption key.

Answer

Grant the storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.

Answer

Enable uniform bucket-level access on the bucket.

Answer

Create an organization policy constraint that requires CMEK for all Cloud Storage buckets.