PCSE Supporting compliance requirements Practice Test 4 — 15 Questions

Question 1

An organization wants to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled to simplify access control and meet compliance requirements. What Google Cloud service should they use to enforce this?

Accepted Answer

Organization Policies. Organization Policies allow administrators to set constraints on Google Cloud resources at the organization, folder, or project level. The `constraints/storage.uniformBucketLevelAccess` constraint can be applied to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled, simplifying access control and meeting compliance requirements.

Answer

VPC Service Controls

Answer

Cloud IAM

Answer

Cloud Armor

Question 2

A government contractor uses Google Cloud with Assured Workloads. They need to ensure that data stored in BigQuery is encrypted with keys generated and stored in a Cloud HSM key ring located in a specific region. The keys must be rotated every 90 days. Which approach meets these requirements?

Accepted Answer

Create a Cloud HSM key ring in the desired region, create a key with a rotation period of 90 days, and use that key to protect the BigQuery dataset via CMEK.. Option A is correct because it uses a Cloud HSM key ring in the desired region, which meets the requirement for hardware-backed key generation and storage. Setting a rotation period of 90 days on the key satisfies the rotation requirement, and using that key as a customer-managed encryption key (CMEK) for BigQuery ensures data is encrypted with the specified key.

Answer

Use Cloud KMS with a software key and enable automatic rotation of 90 days.

Answer

Create a Cloud HSM key ring and manually rotate keys every 90 days.

Answer

Use Cloud External Key Manager (EKM) with an external key management partner.

Question 3

A retail company processes customer payment data and must comply with PCI DSS. They use Cloud SQL for database storage. They need to ensure that all database backups are encrypted at rest. What should they do?

Accepted Answer

No additional action required; Cloud SQL automatically encrypts backups.. C is correct because Cloud SQL automatically encrypts all data at rest, including backups, using either Google-managed encryption keys or customer-managed encryption keys (CMEK) if configured. No additional action is required to enable backup encryption by default, as this is a built-in feature of the service to meet PCI DSS compliance requirements.

Answer

Use Cloud HSM to generate a key and store in Cloud Storage for backup encryption.

Answer

Enable Cloud DLP to inspect and encrypt backup data.

Answer

Use Cloud KMS to create a CMEK key and attach it to the Cloud SQL instance.

Question 4

A company needs to comply with GDPR and must implement data subject access request (DSAR) capabilities. Which TWO Google Cloud services should they use to locate and export personal data across various data stores?

Accepted Answer

BigQuery. BigQuery is correct because it can be used to query and export personal data stored in BigQuery tables via SQL, enabling DSAR compliance by locating and extracting data subject information. Cloud Data Loss Prevention (DLP) is correct because it can inspect and classify personal data across various Google Cloud data stores (including Cloud Storage, BigQuery, and Datastore) and de-identify or export findings, directly supporting DSAR workflows.

Answer

Cloud Key Management Service (KMS)

Answer

Cloud Storage

Answer

VPC Service Controls

Question 5

A financial institution must meet SOX compliance requirements for audit trail integrity. Which THREE measures should they implement to ensure Cloud Audit Logs are immutable and securely stored?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS for audit logs.. Option B is correct because using customer-managed encryption keys (CMEK) with Cloud KMS ensures that audit logs are encrypted with keys under the customer's control, preventing unauthorized decryption even by Google. This satisfies SOX requirements for data integrity and confidentiality, as the logs cannot be tampered with or accessed without the key.

Answer

Use VPC Service Controls to prevent exfiltration of logs.

Answer

Set up Cloud IAM roles to restrict who can read audit logs.

Question 6

A company is deploying a new application that must comply with HIPAA. They are using Google Cloud services. Which TWO services are required to be enabled with appropriate configurations to support HIPAA compliance?

Accepted Answer

Cloud Key Management Service (KMS) with customer-managed keys (CMEK). Cloud Key Management Service (KMS) with customer-managed encryption keys (CMEK) is required for HIPAA compliance because it allows the customer to control the encryption keys used to protect protected health information (PHI) at rest. HIPAA mandates that covered entities implement mechanisms to encrypt and decrypt PHI, and using CMEK ensures the customer retains sole control over key material, which is a key requirement for meeting the Security Rule's addressable implementation specification for encryption.

Answer

Cloud Armor

Answer

Cloud Content Delivery Network (CDN)

Answer

Cloud Functions

Question 7

A security engineer notices that some developers are still uploading their own public SSH keys to Compute Engine instances despite the organization policy above being applied to the folder. What is the most likely reason?

Accepted Answer

The policy disables uploading service account keys, not user SSH keys.. Option C is correct because the organization policy described likely restricts the uploading of service account keys, not user SSH keys. The policy in question is typically the 'Disable service account key upload' constraint (iam.disableServiceAccountKeyUpload), which prevents users from creating or uploading external service account keys. It does not affect the ability to add public SSH keys to Compute Engine instances, which is governed by separate metadata-based mechanisms (e.g., oslogin or instance metadata). Therefore, developers can still upload their own SSH keys despite the policy being applied.

Answer

The policy only applies to projects, not folders.

Answer

The policy takes 24 hours to propagate to all projects.

Answer

The policy was applied at the organization level, not the folder level.

Question 8

A compliance officer reviews the Cloud Audit Log entry above and wants to know if any sensitive data was exposed during the instance creation. What is the best course of action?

Accepted Answer

Enable data access audit logs for Compute Engine to capture request payloads.. Option A is correct because enabling data access audit logs for Compute Engine captures the request payloads of API calls, including the instance creation request. This allows the compliance officer to inspect the exact parameters sent, such as any sensitive data that might have been passed as metadata or startup scripts, which are not included in the default admin activity audit logs. Data access audit logs provide the granularity needed to determine if sensitive data was exposed during the operation.

Answer

Check the status field to see if the operation failed, which might indicate a misconfiguration.

Answer

Analyze the log entry to see the image used; the image metadata is included.

Answer

Use Cloud DLP to scan the log entry for sensitive data.

Question 9

A security engineer runs the above query in BigQuery and finds a column containing Social Security Numbers (SSNs). They must ensure that all SSNs in the dataset are automatically encrypted at rest using customer-managed keys (CMEK) and also that future queries do not expose SSNs to users without decryption access. Which approach should they take?

Accepted Answer

Enable CMEK on the dataset, create an authorized view that excludes the sensitive column, and grant view access to users.. Option D is correct because enabling CMEK on the dataset ensures all data, including SSNs, is encrypted at rest with customer-managed keys. Creating an authorized view that excludes the sensitive column and granting view access to users prevents exposure of SSNs in query results while still allowing access to non-sensitive data. This approach meets both the encryption and access control requirements without requiring manual encryption or de-identification.

Answer

Use BigQuery with CMEK on the dataset and create a separate table with encrypted columns.

Answer

Use Cloud DLP to de-identify the data in the table and then restrict access to the de-identified column.

Answer

Use Cloud KMS to encrypt the column values and store the encrypted data in BigQuery.

Question 10

A company needs to store PII in Google Cloud and comply with GDPR data residency requirements. What is the primary Google Cloud feature to enforce data residency?

Accepted Answer

VPC Service Controls. VPC Service Controls (option D) is the primary Google Cloud feature to enforce data residency because it allows you to define perimeters that restrict data movement and access to specific Google Cloud services within a chosen region. By creating a VPC Service Controls perimeter, you can prevent data from being copied or accessed outside of the allowed geographic boundaries, directly addressing GDPR data residency requirements. This is achieved through context-aware access policies that block egress of data to unauthorized regions, even if an attacker gains access to a project.

Answer

Organization policies

Answer

Cloud Data Loss Prevention

Answer

Cloud KMS

Question 11

For HIPAA compliance, which Google Cloud product provides a business associate agreement (BAA) and a dedicated environment for protected health information?

Accepted Answer

Assured Workloads. Assured Workloads is the correct answer because it enables customers to deploy workloads that must comply with HIPAA by providing a BAA-ready environment with enforced controls, including data residency, encryption, and access restrictions. It creates a dedicated folder with pre-configured security and compliance policies, ensuring that protected health information (PHI) is handled in a Google Cloud environment that meets HIPAA requirements.

Answer

Confidential VMs

Answer

GKE Security Posture

Answer

Cloud Healthcare API

Question 12

Which Google Cloud audit log captures administrator activity and is enabled by default?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are enabled by default in Google Cloud and capture all administrator actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. These logs are essential for compliance and security auditing because they record 'who did what, where, and when' for management activities, and they cannot be disabled.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 13

A financial institution is required to use customer-managed encryption keys (CMEK) for all data at rest in Google Cloud. They need to prevent key deletion by anyone except a specific IAM role. What should they do?

Accepted Answer

Enable destroy protection on the key ring. Option A is correct because enabling destroy protection on the key ring prevents any Cloud KMS key within that key ring from being destroyed, regardless of IAM permissions. This is a key ring-level setting that overrides IAM roles, ensuring that only a specific IAM role (e.g., cloudkms.admin) can disable destroy protection and then delete keys, meeting the requirement to restrict key deletion to a specific role.

Answer

Use Organization Policies with a constraint to restrict key destruction

Answer

Assign the cloudkms.admin role only to a security team

Answer

Enable key rotation on the Cloud KMS key

Question 14

A company uses Cloud Audit Logs for compliance. They want to capture all data access events to a Cloud Storage bucket containing sensitive data. What must they enable?

Accepted Answer

Data Access audit logs with a configuration to log all methods. Data Access audit logs record API calls that read or modify customer data, such as reading objects from a Cloud Storage bucket. To capture all data access events, including reads and writes, you must enable Data Access audit logs and configure them to log all methods (not just admin methods). This ensures compliance by recording every access to the sensitive data.

Answer

System Event audit logs

Answer

Admin Activity audit logs

Answer

Access Transparency logs

Question 15

To comply with regulatory requirements, a company needs to prevent service account keys from being created for all projects. What should they use?

Accepted Answer

Organization policy with a constraint. Organization policies with constraints allow you to enforce restrictions across all projects in an organization. The `constraints/iam.disableServiceAccountKeyCreation` constraint specifically prevents the creation of service account keys, ensuring compliance with regulatory requirements that prohibit long-lived keys. This is a native Google Cloud IAM feature that applies at the organization, folder, or project level.

Answer

VPC Service Controls

Answer

Security Command Center

Answer

IAM conditions