PCSE Supporting compliance requirements Practice Test 6 — 15 Questions

Question 1

A company handling credit card information must comply with PCI DSS. They use Cloud KMS with CMEK keys stored in a key ring. During a compliance audit, the auditor asks how keys are protected against unauthorized use by Google. What should the company explain?

Accepted Answer

They store keys in Cloud HSM, which ensures keys never leave the HSM and are bound to a specific project. Option A is correct because Cloud HSM provides a FIPS 140-2 Level 3 validated hardware security module (HSM) where customer-managed encryption keys (CMEK) are generated and used exclusively within the HSM boundary. The keys never leave the HSM in plaintext, and access is bound to the specific Google Cloud project, ensuring that even Google administrators cannot extract or use the keys outside the authorized project context.

Answer

They use customer-supplied encryption keys (CSEK), so Google never has access to keys

Answer

They use Cloud KMS with CMEK, and the keys are encrypted using Google-managed key encryption keys (KEKs)

Answer

They enabled Access Approval, so Google must obtain approval before accessing keys

Question 2

A company needs to respond to a GDPR data subject deletion request for a user's data stored across BigQuery and Cloud Storage. The data must be completely erased upon request. What is the most effective approach to ensure compliance?

Accepted Answer

Use Cloud DLP to identify the user's data across services, delete the data using API calls, and verify deletion with Cloud Audit Logs. Option A is correct because Cloud DLP can be used to inspect and classify the user's data across BigQuery and Cloud Storage, then you can programmatically delete the identified data via API calls. Cloud Audit Logs provide a verifiable record that the deletion was performed, which is essential for demonstrating compliance with GDPR's right to erasure.

Answer

Set up BigQuery time-based table expiration and Cloud Storage lifecycle policies with a 1-day deletion rule

Answer

Use Cloud Identity-Aware Proxy to block the user's access and mark the data as deleted

Answer

Enable Access Transparency logs and request Google to delete the data on their behalf

Question 3

A company uses Forseti Security to monitor their GCP environment for compliance violations. They want to automatically enforce policies that prevent the deployment of resources without required labels. What should they do?

Accepted Answer

Use Forseti Config Validator with a deny policy that blocks creation of resources without required labels. Forseti Config Validator can enforce policies at deployment time by using a deny policy that blocks resource creation if required labels are missing. This is the correct approach because it prevents non-compliant resources from being created in the first place, rather than detecting and remediating them after the fact.

Answer

Configure Forseti Inventory to scan and report resources missing labels, then manually delete them

Answer

Enable VPC Service Controls to restrict projects without labels from accessing resources

Answer

Use Cloud Asset Inventory to trigger Cloud Functions that delete resources missing labels

Question 4

A company must enforce that no data can be accessed from outside a specific set of Google Cloud projects. They want to ensure that only authorized services can communicate between projects. Which TWO controls should they implement? (Choose TWO.)

Accepted Answer

Access Context Manager. VPC Service Controls create a perimeter around resources, and Access Context Manager defines context-aware access policies based on attributes like IP range, device policy, etc.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud NAT

Question 5

A healthcare organization is migrating to Google Cloud and needs to achieve HIPAA compliance. Which THREE actions are required to meet HIPAA requirements on GCP? (Choose THREE.)

Accepted Answer

Enable Cloud Audit Logs for all services handling ePHI. Option A is correct because enabling Cloud Audit Logs for all services handling ePHI is a direct requirement under HIPAA's Security Rule (45 CFR § 164.312(b)), which mandates audit controls to record and examine activity in systems that contain or use electronic protected health information. Cloud Audit Logs provide immutable, tamper-evident logs of admin activities, data access, and system events, which are essential for demonstrating compliance during audits or breach investigations. Without these logs, the organization cannot meet the audit control standard for ePHI environments on GCP.

Answer

Enable VPC Flow Logs for all subnets

Answer

Use Cloud NAT for outbound internet access

Question 6

A company must ensure that all data stored in Google Cloud remains within specific geographic regions to meet data residency regulations. Which TWO methods enforce data location restrictions? (Choose TWO.)

Accepted Answer

Organization Policy constraints (constraints/gcp.resourceLocations). Option C is correct because Organization Policy constraints, specifically `constraints/gcp.resourceLocations`, allow administrators to define a list of allowed geographic locations (e.g., `in:us-central1` or `in:europe-west1`) where Google Cloud resources can be created. This policy is enforced at the project, folder, or organization level, preventing resource creation outside the permitted regions, which directly addresses data residency requirements.

Answer

VPC Service Controls

Answer

Cloud Data Loss Prevention scan

Answer

Cloud Interconnect

Question 7

Refer to the exhibit. A compliance officer sees this Organization Policy applied at the organization level. Which compliance requirement does this policy primarily address?

Accepted Answer

Data residency. The Organization Policy shown restricts the allowed locations for Compute Engine resources to a specific region (e.g., us-central1). This directly enforces data residency requirements by preventing resources from being created or moved outside of approved geographic boundaries, ensuring that data remains within a particular jurisdiction to comply with regulations like GDPR or HIPAA.

Answer

Encryption key management

Answer

Audit logging

Answer

Access control

Question 8

Refer to the exhibit. A security engineer configured Data Access audit logs for all services. During a compliance audit, the auditor flags this configuration as deficient. What is the most likely reason?

Accepted Answer

The service account is exempted from DATA_READ logs, which may allow unlogged data access. Exempting a service account from DATA_READ logging means data access by that service account is not logged, creating a gap in audit coverage that many compliance frameworks (e.g., PCI DSS) require to be comprehensive.

Answer

The audit config does not include DATA_WRITE logging

Answer

ALL_SERVICES includes unsupported services for data access logs

Answer

The audit config should be applied at the project level, not organization level

Question 9

Refer to the exhibit. A company configured this VPC Service Controls perimeter for a PCI DSS project. The compliance auditor notes that BigQuery data can be accessed from outside the perimeter. Which change must be made to restrict access to BigQuery?

Accepted Answer

Set the perimeter enforcement mode to enforced instead of dry run. The dry run mode logs violations but does not enforce restrictions, allowing BigQuery data to be accessed from outside the perimeter. Changing the enforcement mode to 'enforced' activates the VPC Service Controls policies, blocking all out-of-perimeter access to the configured services. This directly addresses the auditor's finding by ensuring that only requests from within the perimeter are allowed.

Answer

Add storage.googleapis.com to restrictedServices

Answer

Move BigQuery to a separate perimeter

Answer

Add allUsers to the perimeter's access levels

Question 10

A healthcare company must export Cloud Audit Logs to an external SIEM for HIPAA compliance. The logs must be retained for 7 years and be immutable. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use a log sink to export logs to a Cloud Storage bucket with a retention policy of 7 years and Object holds enabled.. Option D is correct because Cloud Storage buckets support Object holds, which prevent object deletion or modification, ensuring immutability. A retention policy set to 7 years enforces the minimum retention period required by HIPAA. This combination meets compliance needs with minimal operational overhead, as it leverages native GCP features without requiring custom infrastructure or manual management.

Answer

Configure a log sink to send logs to an on-premises syslog server via VPN.

Answer

Create a Pub/Sub sink with a retention policy that delivers logs to a custom application.

Answer

Stream audit logs to BigQuery using a log sink, and set table expiration to 7 years.

Question 11

A financial institution is subject to GDPR and requires encryption at rest for all data in Cloud Storage. They want to use CMEK but also need to log all key access events. Which combination of services meets both requirements with least effort?

Accepted Answer

Use CMEK with Cloud KMS and enable Cloud Audit Logs with Data Access audit logs for Cloud KMS.. Option B is correct because Cloud KMS keys can be used with Cloud Storage via CMEK, and Cloud Audit Logs automatically log key access via Data Access audit logs. Option A is wrong because CSEK is deprecated. Option C is wrong because Cloud HSM is a hardware-backed key management, but the key access logs are still in Cloud Audit Logs. Option D is wrong because rotating keys is not required for compliance; logging access is.

Answer

Use Cloud HSM to protect keys, and enable Cloud Audit Logs for Cloud HSM.

Answer

Use CMEK with Cloud KMS and set key rotation every 30 days.

Answer

Use CSEK (customer-supplied encryption keys) and enable Cloud Audit Logs for all services.

Question 12

A company must ensure that only authorized users can access sensitive data in Cloud Storage for PCI DSS compliance. They have configured a bucket with uniform bucket-level access. Which IAM policy should they use to grant access to a security team?

Accepted Answer

Bind the security team to roles/storage.objectViewer at the bucket level.. Option A is correct because the 'Storage Object Viewer' role grants read-only access to objects, which is sufficient for security monitoring. Option B is wrong because the admin role grants full access, violating least privilege. Option C is wrong because bucket-level access is already uniform, so ACLs are not needed. Option D is wrong because the bucket admin role gives full control, which is excessive.

Answer

Bind the security team to roles/storage.legacyBucketReader at the bucket level.

Answer

Use ACLs to give the security team READ access to the bucket.

Answer

Bind the security team to roles/storage.admin at the project level.

Question 13

A multi-national corporation must prevent data exfiltration from a project containing PII for GDPR compliance. They want to restrict access to only allow data transfer within the organization. Which Google Cloud service meets this requirement?

Accepted Answer

Create a VPC Service Control perimeter that includes the project and restricts access to other perimeters.. VPC Service Controls allow you to define perimeters that protect the resources and data of Google Cloud services. By creating a perimeter that includes the project containing PII, you can restrict data transfer to only within the organization, preventing exfiltration to external networks or unauthorized identities, which directly meets GDPR compliance requirements.

Answer

Use firewall rules to block all egress traffic except to approved IP ranges.

Answer

Set IAM policies to deny the storage.objectViewer role to non-compliant users.

Answer

Configure Cloud NAT for the VPC to route traffic through a single IP.

Question 14

A gaming company must comply with the Children's Online Privacy Protection Act (COPPA). They use BigQuery to store user data, including age. They want to automatically classify and restrict access to data of users under 13. Which approach should they take?

Accepted Answer

Use DLP API to inspect BigQuery tables and apply de-identification or restriction policies.. Option A is correct because DLP API can classify sensitive data and set access controls accordingly. Option B is wrong because bucket-level policies apply to Cloud Storage, not BigQuery. Option C is wrong because VPC Service Controls do not inspect data content. Option D is wrong because Data Catalog does not enforce access; it only tags metadata.

Answer

Create a Cloud Data Catalog tag template for age and assign tags to columns, then use IAM to restrict access based on tags.

Answer

Store user data in Cloud Storage with uniform bucket-level access and use IAM to restrict access based on age.

Answer

Use VPC Service Controls to limit access to the BigQuery dataset from only approved IP ranges.

Question 15

A company uses Cloud Audit Logs for compliance and needs to ensure that logs are not tampered with. Which feature should they enable?

Accepted Answer

Enable Access Transparency logs for the project.. Option B is correct because Access Transparency logs are tamper-proof and logged at Google's infrastructure. Option A is wrong because log sinks do not prevent tampering. Option C is wrong because Cloud Logging does not provide inherent immutability. Option D is wrong because Cloud Key Management Service is for encryption, not log integrity.

Answer

Store logs in Cloud Logging with default retention.

Answer

Use Cloud Key Management Service to sign audit logs.

Answer

Set up multiple log sinks to different destinations.