PCSE Practice Test 41 — 15 Questions

Question 1

A financial services firm stores sensitive customer data in Cloud Storage. They want to use Cloud DLP to inspect and de-identify data before it is written to a BigQuery dataset. The data includes names, email addresses, and credit card numbers. They need to replace each detected sensitive value with a surrogate that preserves the original data type and length, and they must be able to reverse the transformation later using a separate key. Which Cloud DLP transformation should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CryptoReplaceFfxFpeConfig with a KMS key. Format-preserving encryption via CryptoReplaceFfxFpeConfig is the only option that both preserves the format and length of the original data and allows reversal with a key. Cloud DLP supports FFPE using a Cloud KMS key, making it suitable for reversible de-identification of names, emails, and credit card numbers while maintaining usability in downstream systems.

Answer

CryptoHashConfig with a transient key

Answer

CharacterMaskConfig with masking character '*'

Answer

ReplaceConfig with a fixed surrogate value

Question 2

A healthcare analytics company stores sensitive patient records in a Cloud Storage bucket. They need to ensure that data is encrypted with a key that they control, that the key material never leaves their on-premises HSM, and that all encryption and decryption operations are performed in their own environment. Which Cloud KMS feature should they use?

Accepted Answer

Cloud External Key Manager (Cloud EKM). Cloud External Key Manager (Cloud EKM) is designed for scenarios where the customer must retain control of key material outside Google Cloud. By integrating with an external key management system, often an on-premises HSM, Cloud EKM ensures that keys are never exposed to Google and that cryptographic operations occur in the customer's environment. This meets the strict data protection and compliance requirements described.

Answer

Cloud HSM with a Cloud KMS key ring

Answer

Cloud KMS with software protection level

Answer

Customer-supplied encryption keys (CSEK) for Cloud Storage

Question 3

A company stores sensitive customer data in a Cloud SQL for PostgreSQL instance. They want to ensure that data is encrypted at rest using a customer-managed encryption key (CMEK) that they control and can rotate. They have created a Cloud KMS key ring and a symmetric key in the same region as the Cloud SQL instance. What should they do next to configure the Cloud SQL instance to use the CMEK?

Accepted Answer

Grant the Cloud SQL service account the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the key.. To use a CMEK with Cloud SQL, the Cloud SQL service account must be granted the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the key. This allows Cloud SQL to perform cryptographic operations with the key. After this, the instance can be configured to use the CMEK. The other options are either incorrect or incomplete steps.

Answer

Enable the Cloud KMS API in the project.

Answer

Create a new Cloud SQL instance with the --encryption-key flag specifying the key.

Answer

Export the key and import it into Cloud SQL.

Question 4

A security engineer needs to ensure that data stored in a Cloud SQL for MySQL instance is encrypted with a customer-managed encryption key (CMEK) and that the key is rotated every 180 days. The engineer also needs to prove to auditors that the data is encrypted with the correct key. What should they do?

Accepted Answer

Create a Cloud KMS key with a 180-day rotation period, configure the Cloud SQL instance to use this key, and enable Cloud Audit Logs for Cloud KMS to track key usage.. The correct approach is to create a CMEK key with the specified rotation, configure Cloud SQL to use it, and enable Cloud KMS audit logs. This ensures encryption with the customer-managed key and provides audit evidence. Other options either use Google-managed keys or do not provide the necessary proof.

Answer

Enable default encryption on the Cloud SQL instance and use Cloud KMS to manage the Google-managed key with rotation.

Answer

Create a Cloud KMS key with a 180-day rotation period, configure the Cloud SQL instance to use this key, and enable Cloud Storage audit logs for the bucket where backups are stored.

Answer

Use Cloud SQL's built-in encryption and export audit logs from Cloud SQL to show that data is encrypted.

Question 5

Your organization uses Cloud KMS to manage encryption keys for various Google Cloud services. A security policy mandates that all symmetric keys used for data at rest must be automatically rotated every 90 days and that old key versions must remain available for decryption for at least 30 days after rotation. How should you configure the key?

Accepted Answer

Set the rotation period to 90 days and set the next rotation time. Old versions remain enabled until you manually disable them, so they are available for decryption.. To meet the policy, set the rotation period to 90 days and the next rotation time. Cloud KMS automatic rotation creates a new key version at each interval but does not disable or destroy old versions. Old versions remain enabled and can decrypt data until you manually disable or destroy them. This satisfies the requirement that old versions remain available for at least 30 days after rotation, as you can disable them later.

Answer

Enable automatic rotation and set the rotation period to 90 days. Old versions are automatically destroyed after 30 days.

Answer

Set the rotation period to 90 days and set the next rotation time. Old versions are automatically retained and can be used for decryption indefinitely.

Answer

Set the rotation period to 30 days and set the next rotation time. Old versions are automatically disabled after 90 days.

Question 6

A healthcare analytics company stores protected health information in Cloud Storage buckets. Compliance requires that data be encrypted with keys that the company generates and manages on-premises, and that all cryptographic operations occur outside Google Cloud. The security team must ensure the encryption keys never leave their own hardware security modules. Which Cloud KMS feature should they implement?

Accepted Answer

Cloud External Key Manager (Cloud EKM) with an external key manager connected over the internet or a VPC.. The requirement is that encryption keys be generated and managed outside Google Cloud, in the company's own hardware security modules. Cloud External Key Manager (Cloud EKM) is designed for exactly this: it integrates Cloud KMS with an external key manager so that key material never enters Google Cloud, while still allowing services like Cloud Storage to use those keys.

Answer

Cloud HSM with a hardware-backed key ring in the same region as the data.

Answer

Customer-supplied encryption keys (CSEK) supplied with each Cloud Storage API request.

Answer

Cloud KMS with automatic rotation every 90 days and a multi-region key ring.

Question 7

A security team needs to ensure that sensitive data stored in Cloud Storage is protected against accidental public exposure. They want to automatically detect and remediate any bucket that becomes publicly accessible, and they need an audit trail of all such events. Which Google Cloud solution should they implement?

Accepted Answer

Cloud Asset Inventory with a feed that triggers a Cloud Function to remove public IAM bindings and log the event to Cloud Logging.. Cloud Asset Inventory provides a real-time feed of asset changes, including IAM policy updates. By creating a feed that monitors for public IAM bindings on Cloud Storage buckets, you can trigger a Cloud Function to automatically remove those bindings and log the event. This ensures that any public exposure is quickly remediated and that an audit trail exists. This solution meets both the automatic remediation and audit logging requirements.

Answer

Cloud Security Command Center with Security Health Analytics to detect public buckets and manually remediate them.

Answer

VPC Service Controls perimeter around the Cloud Storage project to prevent public access.

Answer

Cloud Storage bucket with Uniform Bucket-Level Access and a Cloud Function that periodically checks for public access and removes it.

Question 8

A startup is developing a mobile app that needs to store user credentials for third-party APIs. They want a fully managed Google Cloud service that handles secret storage, versioning, and access control, with automatic replication across regions. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is the correct choice because it is a fully managed service designed for storing and accessing secrets. It offers versioning, automatic multi-region replication, and integrates with IAM for access control. The startup can store API keys and credentials securely, and retrieve them via API calls, without managing infrastructure. This aligns with the need for a managed solution that handles storage, versioning, and access control.

Answer

Cloud KMS

Answer

Cloud Storage with customer-managed encryption keys

Answer

Firestore in Datastore mode

Question 9

A security engineer is configuring Cloud KMS for a regulated workload and must ensure that key material is generated and protected inside a hardware security module, and that the keys can be used by workloads in a different Google Cloud project without copying key material. (Choose two.)

Accepted Answer

Grant the consuming project's service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key. HSM protection level ensures the key material is generated and held inside a validated hardware security module, and cross-project consumption is enabled by granting the consuming identity the CryptoKey Encrypter/Decrypter role on that specific key. Exporting material, using Cloud EKM, or attempting to replicate key rings all either weaken hardware protection or misrepresent how Cloud KMS shares keys across projects.

Answer

Replicate the key ring into the consuming project by creating a peer key ring

Answer

Export the key material from the security project and import it into a key ring in the consuming project

Answer

Enable Cloud External Key Manager and reference an external key version URI for the key

Question 10

A company uses Cloud DLP to inspect a BigQuery table for sensitive data. They want to replace all detected email addresses with a consistent token that can be used for joining with other tables, but they do not want to store the mapping. Which Cloud DLP transformation should they use?

Accepted Answer

Pseudonymize with a cryptographic key. Pseudonymize with a cryptographic key uses a deterministic encryption process to generate a consistent token for each unique value. This allows joins across tables without storing a mapping. The other transformations either do not produce consistent tokens or are not designed for this purpose.

Answer

Bucketing

Answer

Format-preserving encryption (FPE)

Answer

Replace with infoType

Question 11

A company needs to store database credentials for a production application. The credentials must be encrypted at rest and in transit, and the application should retrieve them at runtime using its service account. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing and accessing secrets. It provides encryption at rest and in transit, versioning, and IAM-based access control. Applications can use their service account to access secrets at runtime. Cloud KMS manages keys, not secrets; Cloud Storage and Firestore are not designed for secret management and lack the necessary security features.

Answer

Firestore

Answer

Cloud KMS

Answer

Cloud Storage with CMEK

Question 12

A media company stores raw interview footage in a Cloud Storage bucket that has Uniform Bucket-Level Access enabled. Legal requires that no object in the bucket be readable by anyone except a small investigations group, and that even project owners cannot grant themselves access. The security team wants a single control that enforces this regardless of future IAM changes. Which control should they apply?

Accepted Answer

Apply an IAM Deny policy on the bucket that denies storage.objects.get to all principals except the investigations group. IAM Deny policies take precedence over allow policies and are not bypassable by project owners using ordinary IAM grants, making them the single control that enforces exclusive read access to the investigations group. Uniform Bucket-Level Access disables ACLs, public access prevention only blocks public principals, and Bucket Lock governs deletion rather than reads. Only the deny policy meets the legal requirement.

Answer

Create an organization policy constraint that disables public access on the bucket

Answer

Set the bucket's default object ACL to private and remove all object ACLs

Answer

Enable Bucket Lock on the bucket with a retention policy covering all objects

Question 13

A security engineer at a retail company is configuring Cloud Storage bucket permissions. The company wants to ensure that only users with the role 'roles/storage.objectViewer' can read objects, but they also want to prevent any user from making objects publicly accessible, even if they have the 'roles/storage.objectAdmin' role. What should the engineer do?

Accepted Answer

Apply an organization policy constraint constraints/storage.publicAccessPrevention set to enforced at the project or organization level.. Enforcing the organization policy constraint constraints/storage.publicAccessPrevention prevents any user, including those with objectAdmin, from making Cloud Storage buckets or objects public. This is a centralized control that overrides individual permissions. The other options either do not prevent public access or are unrelated to the requirement.

Answer

Set the bucket's default object ACL to private and enable Object Lifecycle Management to delete objects after 30 days.

Answer

Enable uniform bucket-level access on the bucket and remove the roles/storage.objectAdmin role from all users.

Answer

Create a VPC Service Controls perimeter around the project and add the Cloud Storage API to the perimeter.

Question 14

A company has a Google Kubernetes Engine (GKE) cluster with several workloads. They want to ensure that only container images that have been scanned for vulnerabilities and signed by a trusted authority are deployed. They also want to receive alerts when an unsigned image is attempted to be deployed. Which Google Cloud service should they use?

Accepted Answer

Binary Authorization with a policy that requires attestations from a trusted attestor, and enable audit logging to capture violations.. Binary Authorization is the Google Cloud service designed to enforce deploy-time policies on GKE. By requiring attestations from a trusted attestor, only images that have been signed are admitted. Audit logging captures violations, which can be used to generate alerts. This combination ensures that unsigned images are blocked and that security teams are notified of attempts.

Answer

Artifact Registry with vulnerability scanning, and use IAM policies to restrict who can push images.

Answer

Container Analysis with vulnerability scanning enabled, and configure Pub/Sub notifications for vulnerabilities.

Answer

Security Command Center Premium with Container Threat Detection enabled, and configure findings to trigger alerts.

Question 15

A company uses Google Cloud and wants to enforce that all external users accessing their web application must be authenticated and authorized via Identity-Aware Proxy (IAP). They need to configure IAP for an external HTTPS load balancer. Which two steps are required to allow access only to members of a specific Google Group? (Choose two.)

Accepted Answer

Grant the roles/iap.httpsResourceAccessor role to the Google Group on the IAP resource.. To protect an external HTTPS load balancer with IAP and restrict access to a specific Google Group, you must enable IAP on the backend service and grant the IAP HTTPS Resource Accessor role to the group. Enabling IAP activates the authentication and authorization layer, and the role grant ensures only group members can access. Other steps like firewall rules or OAuth consent screen settings are either not required or do not achieve the specific access restriction.

Answer

Create a firewall rule allowing traffic from the IP range 35.191.0.0/16 to the backend instances.

Answer

Configure the OAuth consent screen to allow only users from the organization's domain.

Answer

Set up a service account for IAP to use when signing requests.