PCSE Supporting compliance requirements Practice Test 3 — 15 Questions

Question 1

A company is moving sensitive data to Google Cloud and must comply with GDPR data minimization principles. They want to ensure that only the minimum necessary data is collected and processed. Which Google Cloud service should they use to automatically identify and redact sensitive data before storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it provides native capabilities to inspect, classify, and automatically redact sensitive data (e.g., PII, credit card numbers) before storage, directly supporting GDPR data minimization. It uses built-in infoType detectors and can be integrated with Cloud Storage, BigQuery, and other services to apply de-identification transformations such as masking, tokenization, or deletion at ingestion time.

Answer

Cloud Composer

Answer

Cloud Data Fusion

Answer

Cloud Dataprep

Question 2

A government agency requires that all compute resources for a project are physically located in the United States (US) to comply with FedRAMP. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Which configuration ensures that all future resources are created in the US?

Accepted Answer

Set an Organization Policy on the folder containing the project with constraint constraints/gcp.resourceLocations set to allowedLocations list of US regions.. Option C is correct because the Organization Policy constraint `constraints/gcp.resourceLocations` enforces that all future resources in the project (Compute Engine instances, Cloud Storage buckets, BigQuery datasets) are created only in the allowed US regions. This policy is evaluated at resource creation time and prevents any resource from being provisioned outside the specified locations, directly meeting the FedRAMP requirement for physical location in the US.

Answer

Configure VPC Service Controls with a perimeter that only allows access from US-based IP addresses.

Answer

Assign the Compute Admin role to a security admin and restrict them to only create resources in US regions.

Answer

Use Cloud KMS with a key from a US-based location and require that all resources use that key.

Question 3

A company is undergoing a SOC 2 audit and needs to demonstrate that access to production data is monitored and that any changes to IAM policies are reviewed. They have enabled Cloud Audit Logs. The auditor asks for a report showing all IAM policy changes in the last 6 months. The security team notices that some older changes are missing. What is the most likely reason?

Accepted Answer

The logs were never exported to a long-term storage destination.. Option D is correct because Cloud Audit Logs are retained for a limited default period (30 days for Admin Activity logs), and the question states that the company enabled Cloud Audit Logs but does not mention exporting them to a long-term destination like Cloud Storage or BigQuery. Without such an export, logs older than 30 days are automatically deleted, which explains why some IAM policy changes from the last 6 months are missing. The auditor's requirement for a 6-month report necessitates a configured log sink to a durable storage destination.

Answer

The log sink filter is excluding IAM policy changes.

Answer

Admin Activity audit logs are only retained for 30 days by default unless exported to a destination like Cloud Storage or BigQuery.

Answer

IAM policy changes are logged in Data Access audit logs, which are not enabled by default.

Question 4

A company needs to ensure that all data stored in Cloud Storage is encrypted using a key that is rotated every 30 days. Which encryption option should they choose to meet this requirement with automated rotation?

Accepted Answer

Customer-Managed Encryption Key (CMEK) using Cloud KMS. Option B is correct because Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow you to control and rotate encryption keys on a schedule. Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 30 days), meeting the requirement without manual intervention.

Answer

Cloud External Key Manager (EKM)

Answer

Google-managed encryption keys

Answer

Customer-Supplied Encryption Key (CSEK)

Question 5

A company is deploying a multi-region application in Cloud Run and must comply with data residency requirements in the European Union (EU). They want to ensure that only EU-based Cloud Run instances are created. Which approach should they use?

Accepted Answer

Set an Organization Policy with constraints/gcp.resourceLocations to restrict allowed regions to EU regions.. Option B is correct because Organization Policies with the `constraints/gcp.resourceLocations` constraint allow administrators to enforce a list of allowed Google Cloud regions for resource creation. By setting this policy to include only EU-based regions (e.g., `europe-west1`, `europe-west4`), the company ensures that Cloud Run instances cannot be created outside the EU, directly meeting data residency compliance requirements. This is a preventive control that applies at the project or folder level, overriding any developer choices.

Answer

Add a label to the Cloud Run service specifying the region and rely on developers to follow it.

Answer

Use VPC Service Controls to limit access to the Cloud Run service from outside the EU.

Answer

Configure VPC Firewall rules to only allow egress to EU IP addresses.

Question 6

A company is using Cloud SQL for MySQL to store customer data subject to SOX compliance. They need to ensure that all database changes are audited and that logs are immutable. They have enabled audit logs and exported them to a Cloud Storage bucket. However, the auditor discovers that some logs were deleted from the bucket. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket has a lifecycle rule that deletes objects after a set number of days.. Option D is correct because Cloud Storage lifecycle rules can automatically delete objects after a specified number of days. If a lifecycle rule is configured on the bucket, it would delete audit logs regardless of the export process, making them unavailable to the auditor. This is the most likely cause of logs being deleted from the bucket, as the other options do not explain actual deletion of already-exported objects.

Answer

The log sink filter is excluding certain events, causing incomplete export.

Answer

The bucket has retention policy enabled, which prevents deletion until the retention period expires.

Answer

The service account used for export does not have the storage.objects.delete permission.

Question 7

Which TWO actions should be taken to ensure that a Google Cloud environment meets PCI-DSS requirements for protecting cardholder data? (Choose two.)

Accepted Answer

Encrypt all transmission of cardholder data using TLS 1.2 or higher.. Option B is correct because PCI-DSS Requirement 4 mandates that cardholder data must be encrypted during transmission over open, public networks. TLS 1.2 or higher is the specified protocol, and Google Cloud services such as HTTPS load balancers and Cloud VPN support this encryption natively, ensuring compliance with the transmission security requirement.

Answer

Use IAM roles to restrict access to cardholder data to the minimum necessary.

Answer

Use Cloud Data Loss Prevention to tokenize all credit card numbers before storage.

Answer

Enable automatic DLP inspection triggers for all Cloud Storage buckets.

Question 8

Which THREE steps are necessary to ensure that a Google Cloud project complies with FedRAMP Moderate baseline requirements for access control? (Choose three.)

Accepted Answer

Set up session expiration policies that automatically log out inactive users after 15 minutes.. Option A is correct because FedRAMP Moderate requires session timeout policies to mitigate the risk of unauthorized access from unattended sessions. Google Cloud IAM session settings allow you to enforce a maximum session duration, and setting it to 15 minutes aligns with the FedRAMP requirement for automatic logout of inactive users. This directly addresses the access control family (AC-12) in the FedRAMP baseline.

Answer

Configure Cloud NAT to allow instances to access the internet without public IPs.

Answer

Implement VPC Service Controls to prevent data exfiltration.

Question 9

Which TWO configurations are required to use Customer-Managed Encryption Keys (CMEK) with Cloud Storage to meet a compliance requirement that keys must be rotated every 30 days? (Choose two.)

Accepted Answer

Create a Cloud KMS key ring and key with a rotation period of 30 days.. Option C is correct because Cloud KMS allows you to set a rotation period on a key, and when you use a CMEK with Cloud Storage, the key is used to encrypt the data encryption keys (DEKs). Setting a rotation period of 30 days ensures that the key material is automatically rotated every 30 days, meeting the compliance requirement. Option E is correct because the Cloud Storage service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role to be authorized to use the CMEK for encrypting and decrypting objects.

Answer

Set a key destruction policy to prevent accidental deletion of the key.

Answer

Use Cloud External Key Manager (EKM) to manage the key externally.

Answer

Use a Cloud HSM key with protection level HSM to meet key storage requirements.

Question 10

A healthcare organization is migrating to Google Cloud and needs to ensure that all data stored in Cloud Storage is encrypted at rest with customer-managed encryption keys (CMEK) to meet HIPAA requirements. The security team wants to centrally manage key rotation and access. Which solution should they implement?

Accepted Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK and enable key rotation.. Option C is correct because Cloud KMS with CMEK allows the organization to centrally manage encryption keys, including automated key rotation, while maintaining customer control over the keys used to encrypt Cloud Storage data. This meets HIPAA requirements for encryption at rest with customer-managed keys, as Cloud KMS integrates directly with Cloud Storage to enforce encryption using the specified key.

Answer

Use Cloud Data Loss Prevention (DLP) to de-identify data before storing.

Answer

Use Cloud Hardware Security Module (Cloud HSM) with CMEK.

Answer

Use customer-supplied encryption keys (CSEK) stored in Cloud Storage.

Question 11

A multinational corporation must comply with GDPR and requires that data stored in BigQuery is physically located in the European Union. They have set up BigQuery datasets in the EU region. However, a compliance audit reveals that some queries may process data in the US region due to BigQuery's multi-region behavior. What should the organization do to ensure data remains in the EU?

Accepted Answer

Create BigQuery datasets in a specific European region (e.g., europe-west1) instead of the EU multi-region.. Option A is correct because creating a BigQuery dataset in a specific European region (e.g., europe-west1) ensures that all data storage and query processing are physically confined to that single region. In contrast, the EU multi-region (EU) is a geographic entity that includes multiple Google Cloud regions within the European Union, and BigQuery may process data in any of those regions, including potentially outside the EU if the multi-region expands. By using a specific regional dataset, the organization guarantees that data never leaves the designated European location, meeting GDPR's data residency requirements.

Answer

Use the EU multi-region dataset and configure VPC Service Controls to restrict access.

Answer

Enable BigQuery CMEK with keys stored in a European Cloud KMS key ring.

Answer

Use BigQuery reservations to guarantee that data processing happens in the EU.

Question 12

A company is deploying a new application that will process credit card data and must comply with PCI DSS. They plan to use Google Cloud services. Which service should they use to detect and redact sensitive data stored in Cloud Storage buckets?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and redact sensitive data such as credit card numbers (PANs) in Cloud Storage buckets. It uses built-in infoType detectors (e.g., `CREDIT_CARD_NUMBER`) to identify PCI DSS-protected data and can automatically apply de-identification transformations like redaction or masking to comply with PCI DSS requirements.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud Audit Logs

Question 13

An organization uses Assured Workloads for Google Cloud to meet FedRAMP compliance. They have enabled Access Transparency logs. During an audit, they need to provide evidence that Google personnel access was logged and reviewed. What is the primary benefit of using Access Transparency?

Accepted Answer

It provides logs detailing the actions of Google personnel when accessing customer data.. Option D is correct because Access Transparency logs provide near-real-time logs of Google administrators' access to customer data. Option A is wrong because Access Transparency does not block access; it logs it. Option B is wrong because encryption is separate. Option C is wrong because VPC Service Controls, not Access Transparency, restrict data movement.

Answer

It blocks all Google personnel access to customer data.

Answer

It encrypts data with customer-managed keys.

Answer

It prevents data from being moved outside the organization's VPC.

Question 14

A company is migrating a legacy on-premises application to Google Compute Engine. The application requires a static IP address for compliance with a regulatory requirement that outbound connections to a partner's IP whitelist must originate from a known, fixed IP. The application will run in a managed instance group (MIG) for high availability. Which of the following solutions meets the compliance requirement?

Accepted Answer

Use a regional external HTTPS load balancer with a static IP address and configure the MIG to route outbound traffic through the load balancer.. Option B is correct because a regional external HTTPS load balancer with a static IP address can be used as a forward proxy for outbound traffic. By configuring the managed instance group (MIG) to route all egress traffic through the load balancer, all outbound connections will originate from the load balancer's static IP, meeting the compliance requirement for a known, fixed source IP. This approach ensures high availability through the MIG while maintaining a single static IP for partner whitelisting.

Answer

Configure VPC Service Controls to allow egress only from a specific IP range.

Answer

Assign static external IP addresses to each instance in the MIG and configure the partner firewall accordingly.

Answer

Use Cloud NAT with a static NAT IP address for all egress traffic from the instances.

Question 15

A financial services company must retain audit logs for seven years to meet regulatory requirements. They are using Cloud Audit Logs. Which strategy should they implement to ensure logs are not deleted or modified during the retention period?

Accepted Answer

Export logs to Cloud Storage and apply a retention policy that is locked to prevent deletion.. Option C is correct because Cloud Storage buckets with a locked retention policy provide immutable storage, preventing any deletion or modification of objects during the retention period. This meets the regulatory requirement for audit logs to be retained for seven years without alteration. Exporting logs to Cloud Storage and locking the retention policy ensures compliance with data retention regulations.

Answer

Export logs to BigQuery and set table expiration to 7 years.

Answer

Export logs to a Pub/Sub topic, then subscribe and store in a custom database.

Answer

Store logs in the default Cloud Logging bucket and set a retention period of 7 years.