PCSE Supporting compliance requirements — 20 Questions

Question 1

A company needs to retain audit logs for 7 years to meet regulatory compliance. They are using Cloud Logging. Which log storage strategy should they use to minimize costs while meeting the requirement?

Accepted Answer

Use a log sink to export logs to Cloud Storage with a retention policy of 7 years and nearline storage class.. Option C is correct because exporting logs to Cloud Storage via a log sink allows you to set a bucket retention policy of 7 years, meeting compliance requirements. Using the nearline storage class minimizes costs for logs that are accessed infrequently, as it offers lower storage costs than standard storage while still providing the necessary durability and retention capabilities.

Answer

Store logs in the _Required log bucket with a custom retention of 7 years.

Answer

Disable logging for non-critical resources to reduce log volume and retain only essential logs.

Answer

Use a log sink to export logs to BigQuery and set the table expiration to 7 years.

Question 2

A healthcare organization must ensure that only authorized personnel can access Protected Health Information (PHI) stored in Cloud Storage. They need to enforce encryption at rest and control access based on data classification. Which combination of Google Cloud services should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS and VPC Service Controls.. Option D is correct because it combines customer-managed encryption keys (CMEK) with Cloud KMS to enforce encryption at rest using keys controlled by the organization, and VPC Service Controls to restrict data access based on data classification by creating a security perimeter around Cloud Storage. This ensures that only authorized personnel within the defined perimeter can access PHI, meeting both encryption and access control requirements.

Answer

Use customer-supplied encryption keys (CSEK) and Cloud Audit Logs.

Answer

Use Cloud HSM for key management and Cloud DLP to inspect data.

Answer

Enable Access Transparency and use Organization Policies to restrict resource locations.

Question 3

A financial services company is deploying a multi-region application on Google Kubernetes Engine (GKE) and needs to comply with PCI DSS. They must ensure that cardholder data is encrypted in transit between pods in different clusters. What is the MOST secure way to achieve this?

Accepted Answer

Enable Anthos Service Mesh with mutual TLS (mTLS) across clusters.. Option B is correct because Anthos Service Mesh with mutual TLS (mTLS) provides authenticated and encrypted communication between pods across different GKE clusters, meeting PCI DSS encryption-in-transit requirements. mTLS ensures that each side of the connection presents a certificate, verifying identity and encrypting traffic at the application layer, which is more secure than relying solely on network-level encryption. This approach also integrates with GKE's multi-cluster service mesh capabilities, allowing fine-grained policy enforcement across clusters.

Answer

Configure TLS for each service using a Cloud Load Balancing with SSL policies.

Answer

Use HTTPS between services by configuring ingress with a Google-managed SSL certificate.

Answer

Use VPC Network Peering to connect the clusters and rely on the internal network encryption.

Question 4

A company must implement data residency requirements that prohibit storing data outside the European Union. They are using Cloud Bigtable and need to ensure that backups are also stored within the EU. Which configuration should they choose?

Accepted Answer

Create the Bigtable instance in a single EU region (e.g., europe-west1) and enable automatic backups.. Option D is correct because a single-region Bigtable instance in an EU region (e.g., europe-west1) ensures that all data, including backups, remains within the EU. Enabling automatic backups stores backup data in the same region, satisfying data residency requirements that prohibit storing data outside the EU.

Answer

Create the Bigtable instance with multi-region placement in europe-west1 and europe-west4.

Answer

Create an instance in a dual-region configuration (e.g., europe-west1 and europe-west4) and use backup policies.

Answer

Use a single-region instance in europe-west1 with customer-managed encryption keys (CMEK) for backups.

Question 5

A company is migrating to Google Cloud and needs to comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to use Cloud SQL for MySQL and Cloud Storage. Which TWO actions must they take to ensure HIPAA compliance?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google Cloud.. Option B and D are correct. HIPAA requires a Business Associate Agreement (BAA) with Google, and encryption at rest must be enabled. Cloud SQL and Cloud Storage both support encryption at rest. Option A is wrong because disabling automatic backups is not a HIPAA requirement. Option C is wrong because VPC Service Controls are for data exfiltration prevention, not specifically required by HIPAA. Option E is wrong because HIPAA does not mandate a specific key management service; CMEK is optional.

Answer

Disable automatic backups to prevent exposure of protected health information (PHI).

Answer

Implement VPC Service Controls to create a perimeter around the projects.

Answer

Use customer-managed encryption keys (CMEK) for all services.

Question 6

A company needs to comply with the General Data Protection Regulation (GDPR). They are using BigQuery to store personal data. Which THREE measures should they implement to meet GDPR requirements?

Accepted Answer

Enable audit logs via Cloud Audit Logs to track access to personal data.. Option A is correct because Cloud Audit Logs provide a comprehensive, immutable record of all administrative and data access activities in BigQuery, which is essential for demonstrating GDPR compliance through accountability and traceability. By enabling audit logs, the company can track who accessed personal data, when, and from where, fulfilling the GDPR requirement to maintain records of processing activities.

Answer

Use Cloud KMS to encrypt individual columns containing personal data.

Answer

Store data in a multi-region location like 'EU' to ensure availability across regions.

Question 7

Your company, a global e-commerce platform, must comply with the PCI DSS requirement to secure cardholder data. You have a multi-cloud environment with workloads on Google Cloud and AWS. The Google Cloud environment consists of Compute Engine instances that process credit card transactions, and a Cloud SQL for MySQL database that stores encrypted cardholder data. The security team requires that only specific service accounts can connect to the database, and all connections must be encrypted. Additionally, you need to ensure that the database is not publicly accessible and that all access is logged. You have configured the Cloud SQL instance with a private IP and enabled SSL/TLS. However, a recent audit revealed that a Compute Engine instance with a public IP and no service account was able to connect to the database and execute queries. The instance was not authorized in the Cloud SQL authorized networks. What is the most likely cause of this security gap, and what should you do to prevent it?

Accepted Answer

The instance was in the same VPC and used the default Compute Engine service account with cloudsql.client role. You should disable the default service account and use a custom service account with the least privilege.. Option D is correct because the Compute Engine instance was in the same VPC as the Cloud SQL instance (private IP), and it used the default Compute Engine service account, which had the cloudsql.client role. This allowed the instance to connect via the Cloud SQL Proxy or directly using the private IP without being listed in authorized networks, as VPC internal connectivity bypasses authorized networks. The fix is to disable the default service account and assign a custom service account with only the necessary permissions, ensuring least privilege and preventing unauthorized access.

Answer

The instance bypassed SSL enforcement because the database was configured to accept non-encrypted connections. You should enable the 'require SSL' flag.

Answer

The instance used the Cloud SQL Proxy, which bypasses network controls. You should remove the proxy and require direct connections over private IP.

Answer

VPC Service Controls were not configured to block the connection. You should create a service perimeter to prevent data exfiltration.

Question 8

A financial services company must ensure that all data stored in Cloud Storage is encrypted with customer-managed encryption keys (CMEK) that are rotated every 90 days. They have enabled Organization Policy constraints to enforce CMEK. However, some new buckets are still being created without CMEK. What is the most likely cause?

Accepted Answer

The Organization Policy constraint is not applied to the folder that contains the project.. Organization Policy constraints are hierarchical and must be applied at the project, folder, or organization level to take effect. If the constraint is applied only at the organization level but the project resides in a folder that does not inherit the policy (or the constraint is not applied to that folder), the policy will not enforce CMEK on buckets created in that project. This explains why new buckets can still be created without CMEK despite the policy being enabled elsewhere.

Answer

VPC Service Controls are blocking the use of CMEK.

Answer

The buckets are created using a service account that has the CMEK permission but the key ring is not in the same region.

Answer

The buckets are using the Archive storage class, which does not support CMEK.

Question 9

A healthcare organization uses BigQuery to store patient data with column-level encryption using CMEK. They need to ensure that data is encrypted at rest and in transit, and that only authorized users can query specific columns. Which combination of controls should they use?

Accepted Answer

Use BigQuery column-level encryption with CMEK keys, and grant access via Authorized Views.. Option D is correct because BigQuery column-level encryption with CMEK ensures data is encrypted at rest using customer-managed keys, while Authorized Views provide row- and column-level access control without exposing the underlying encrypted columns to unauthorized users. This combination satisfies both encryption requirements (at rest and in transit, as BigQuery enforces TLS in transit) and fine-grained access control for specific columns.

Answer

Use VPC Service Controls to restrict access to BigQuery datasets, and use IAM conditions to limit column access.

Answer

Use Cloud HSM to create encryption keys and apply them to BigQuery tables using Cloud Key Management Service.

Answer

Use Cloud Data Loss Prevention to de-identify sensitive columns, and then use IAM to control access.

Question 10

A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?

Accepted Answer

Attach to the backend service of the load balancer.. Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.

Answer

Attach to the VPC network that hosts the load balancer.

Answer

Configure as an Organization Policy constraint.

Answer

Configure as a firewall rule in the VPC network.

Question 11

A Cloud Run service is failing to access a secret from Secret Manager. The service account used by Cloud Run has the roles/secretmanager.secretAccessor role. What is the most likely cause of the error?

Accepted Answer

The service account does not have access to the 'latest' version of the secret; it needs explicit version access.. D is correct because Secret Manager requires explicit access to a specific secret version. The `roles/secretmanager.secretAccessor` role grants access to all versions of a secret, but the Cloud Run service must reference a specific version (e.g., 'latest' or a version number) in its configuration. If the service is configured to access the 'latest' version without the `secretmanager.versions.access` permission on that version, access will fail. The error occurs because the service account lacks the necessary permission to access the 'latest' version, even though it has the role.

Answer

VPC Service Controls are blocking access to Secret Manager.

Answer

The service account does not have the iam.serviceAccounts.actAs permission on the Cloud Run service.

Answer

The secret does not exist in the specified project.

Question 12

A company must ensure that all Compute Engine instances use only approved images from a specific project. They want to enforce this using Organization Policy. Which constraint should they use?

Accepted Answer

constraints/compute.restrictImageUsage. The correct constraint is `constraints/compute.restrictImageUsage` because it directly controls which images can be used to create Compute Engine instances by specifying a list of allowed projects. This enforces the requirement that only approved images from a specific project are used, blocking instances launched with images from other projects.

Answer

constraints/compute.restrictAuthorizedDomains

Answer

constraints/compute.trustedImageProjects

Answer

constraints/compute.restrictFirewallRules

Question 13

A company wants to audit all changes to IAM policies in their organization. They need to set up logging to capture these changes. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Enable Admin Activity audit logs for the organization.. Admin Activity audit logs record operations that modify the configuration or metadata of resources, such as IAM policy changes. Enabling Admin Activity audit logs at the organization level captures these changes across all projects within the organization, providing a centralized audit trail. This is the correct step because IAM policy modifications are classified as admin activity, not system events or data access.

Answer

Enable Admin Activity audit logs for each individual project.

Answer

Enable System Event audit logs for the organization.

Answer

Enable Data Access audit logs for the organization.

Question 14

A company is implementing a data retention policy for Cloud Storage buckets. They need to ensure that objects cannot be deleted before a specified retention period. Which THREE features can they use? (Choose THREE.)

Accepted Answer

Retention Policy on the bucket.. A is correct because a Retention Policy on a Cloud Storage bucket enforces a minimum retention period for all objects in the bucket. Once set, objects cannot be deleted or overwritten until the retention period expires, directly meeting the requirement to prevent deletion before a specified time.

Answer

Lifecycle rules with a Delete action.

Answer

Object versioning.

Question 15

A security engineer is using Cloud Asset Inventory to find all Compute Engine instances that are not labeled with a 'compliance' label. Based on the exhibit, which instance(s) are missing the compliance label?

Accepted Answer

instance-2 only. Option B is correct because the exhibit shows that instance-1 has a 'compliance' label with a value of 'true', while instance-2 has no 'compliance' label at all. Cloud Asset Inventory can query assets using label filters; the absence of the 'compliance' label on instance-2 means it fails the compliance labeling requirement. Therefore, only instance-2 is missing the compliance label.

Answer

Both instances

Answer

Neither instance

Answer

instance-1 only

Question 16

A company uses Cloud SQL for MySQL and needs to automate the rotation of database user passwords every 30 days. They want to store the passwords in Secret Manager and have the application retrieve them at runtime. The application runs on Compute Engine. What is the most secure way to allow the Compute Engine instances to access the secrets?

Accepted Answer

Attach a service account to the Compute Engine instances with the role roles/secretmanager.secretAccessor, and grant that service account access to the specific secret versions.. Option A is correct because it follows the principle of least privilege by attaching a service account with the roles/secretmanager.secretAccessor role directly to the Compute Engine instances and granting that service account access only to the specific secret versions needed. This ensures that the instances can authenticate via the default service account metadata server (using OAuth 2.0 tokens) without exposing any long-lived credentials, and the access is scoped to exactly the secrets required for password rotation.

Answer

Grant the roles/secretmanager.secretAccessor role to all service accounts in the project.

Answer

Create a service account key for a dedicated service account, download it to the instance, and use it to access the secret.

Answer

Store the password in instance metadata and have the application read it from the metadata server.

Question 17

A financial services company must store customer transaction records for 7 years to comply with SEC regulations. They currently use Cloud Storage with a lifecycle rule that deletes objects after 365 days. The compliance team needs to ensure that records are immutable and cannot be deleted or modified before the retention period expires. What should the security engineer do?

Accepted Answer

Enable Bucket Lock on the bucket and configure a retention policy of 7 years.. Option D is correct because Bucket Lock is the only Google Cloud Storage feature that enforces immutability by preventing object deletion or modification for a specified retention period. By enabling Bucket Lock and configuring a 7-year retention policy, the company ensures compliance with SEC regulations, as objects cannot be deleted or overwritten even by the bucket owner or lifecycle rules. This overrides the existing 365-day lifecycle rule because retention policies take precedence over lifecycle deletion actions.

Answer

Apply a retention policy to each object individually using object holds.

Answer

Use VPC Service Controls to restrict access to the bucket to only authorized compliance personnel.

Answer

Modify the lifecycle rule to delete objects after 2555 days instead of 365 days.

Question 18

A healthcare organization is migrating sensitive patient data to Google Cloud and must comply with HIPAA. They plan to use Cloud SQL for MySQL with CMEK for encryption at rest. The security team is concerned about key management and access logging. Which additional measure should be implemented to meet HIPAA audit requirements?

Accepted Answer

Enable Data Access audit logs for the Cloud SQL instance and Cloud KMS key.. Option C is correct because HIPAA audit requirements mandate that access to protected health information (PHI) and the keys protecting it must be logged. Enabling Data Access audit logs on both the Cloud SQL instance and the Cloud KMS key captures read, write, and administrative operations, providing the necessary audit trail for compliance. Without these logs, the organization cannot demonstrate who accessed the data or the encryption keys, which is a core HIPAA requirement.

Answer

Configure VPC Service Controls to restrict access to the Cloud SQL instance.

Answer

Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

Answer

Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

Question 19

A global e-commerce company must comply with GDPR and CCPA. They use BigQuery to store customer data and need to ensure that when a user requests data deletion, all copies are deleted within 30 days. Additionally, they want to minimize storage costs. Which TWO actions should they take?

Accepted Answer

Use the DDL statement to drop the table after 30 days using a scheduled query.. Option A is correct because using a DDL statement (e.g., DROP TABLE) in a scheduled query allows you to delete the entire table after exactly 30 days, ensuring all data copies (including storage and any snapshots) are removed. This directly meets the GDPR/CCPA deletion requirement while minimizing storage costs by not retaining data beyond the mandated period.

Answer

Create a Cloud Function to export the data before deletion.

Answer

Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.

Answer

Use BigQuery continuous backups with a 30-day retention.

Question 20

A company has a single Google Cloud project with multiple VPC networks. They need to comply with PCI DSS requirement 1.3.2, which restricts inbound and outbound traffic to only what is necessary. They have a web application running on Compute Engine instances in a VPC with a public subnet and a private subnet. The web servers in the public subnet need to communicate with database servers in the private subnet. Currently, the security engineer has configured firewall rules to allow HTTP/HTTPS traffic from the internet to the web servers, and allow all traffic from the public subnet to the private subnet. The auditor flags that the rule allowing all traffic from the public subnet to the private subnet is too permissive. What should the security engineer do to meet the requirement while maintaining functionality?

Accepted Answer

Create a new firewall rule that allows TCP traffic on port 3306 (MySQL) from the web servers' service accounts to the database servers' IP ranges.. Option D is correct because it implements a least-privilege firewall rule that restricts traffic to only the necessary MySQL port (3306) and uses service accounts as the source identity, which aligns with PCI DSS requirement 1.3.2. By specifying the web servers' service accounts as the source and the database servers' IP ranges as the destination, the rule ensures only authorized web server instances can initiate database connections, rather than allowing all traffic from the entire public subnet. This maintains the required functionality while eliminating the overly permissive 'allow all' rule.

Answer

Use VPC Service Controls to restrict access to the database instances.

Answer

Remove the firewall rule allowing all traffic from the public subnet to the private subnet, and rely on the default allow internal rule.

Answer

Change the existing rule to allow traffic only on ports 3306 and 443 from the public subnet to the private subnet.