PCSE Supporting compliance requirements Practice Test 7 — 15 Questions

Question 1

A pharmaceutical company uses Google Cloud to process clinical trial data subject to HIPAA. They must ensure that only authorized applications can access the data, even if credentials are compromised. Which security control should they implement?

Accepted Answer

Use service account impersonation with IAM conditions to restrict access to specific trusted applications.. Option B is correct because service account impersonation with IAM conditions allows the company to bind access to specific trusted applications by requiring that the caller present a specific service account identity. Even if credentials are compromised, the attacker cannot impersonate that service account unless they also satisfy the IAM conditions (e.g., resource tags, IP ranges, or application identity). This directly addresses the requirement to restrict access to authorized applications only, as per HIPAA's minimum necessary standard.

Answer

Use Workload Identity Federation to allow workloads to access data without service account keys.

Answer

Create a VPC Service Control perimeter that allows only specific service accounts to access the data.

Answer

Require users to MFA and use IAM roles to grant access.

Question 2

A company needs to meet SOC 2 requirements for change management. They want to log all changes to IAM policies in their Google Cloud organization. What should they do?

Accepted Answer

Use Admin Activity audit logs, which are enabled by default.. Option C is correct because Admin Activity audit logs capture all IAM policy changes by default. Option A is wrong because Data Access logs are for data access, not admin changes. Option B is wrong because Cloud Monitoring does not log changes; it monitors metrics. Option D is wrong because Cloud Asset Inventory provides a view but does not log changes in real-time.

Answer

Use Cloud Asset Inventory to scan for changes daily.

Answer

Configure a Cloud Monitoring alert for IAM policy changes.

Answer

Enable Data Access audit logs for all services.

Question 3

A company is using Forseti for compliance automation. They need to ensure that all Cloud Storage buckets are encrypted with CMEK and that buckets without CMEK are flagged. Which Forseti scanner should they use?

Accepted Answer

Location scanner. The Location scanner in Forseti is designed to audit resources based on their location or configuration settings, including encryption status. For Cloud Storage buckets, it can check whether CMEK is enabled by evaluating the bucket's encryption configuration against a policy, flagging any that lack CMEK. This makes it the correct scanner for ensuring CMEK compliance.

Answer

IAM scanner

Answer

Resource scanner

Answer

Bucket ACL scanner

Question 4

Which TWO actions are required to meet FedRAMP Moderate baseline for Google Cloud?

Accepted Answer

Enable Multi-Factor Authentication (MFA) for all Google Cloud users with access to the project.. Option A is correct because FedRAMP Moderate requires multi-factor authentication (MFA) for all users accessing the system, including Google Cloud users. Enabling MFA for all users with access to the project satisfies this control by adding an additional authentication factor beyond a password, as mandated by NIST SP 800-53 IA-2. Option C is correct because FedRAMP Moderate requires encryption at rest for all data, and using Customer-Managed Encryption Keys (CMEK) or Google-managed keys meets this requirement under NIST SP 800-53 SC-28.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage buckets.

Answer

Enable Data Access audit logs for all Google Cloud services in the project.

Answer

Create VPC Service Controls perimeters to restrict data exfiltration.

Question 5

Which THREE steps are necessary to meet SOC 2 Type II requirements using Google Cloud?

Accepted Answer

Enable Cloud Audit Logs and retain them for at least one year.. Option A is correct because SOC 2 Type II requires evidence of continuous monitoring and retention of audit logs for at least one year to demonstrate effective controls. Enabling Cloud Audit Logs in Google Cloud captures admin activity, data access, and system events, which are essential for audit evidence. Retaining these logs for a minimum of one year aligns with the SOC 2 common criteria for monitoring and response.

Answer

Use a single Google Cloud project for all data to simplify auditing.

Answer

Use Customer-Managed Encryption Keys (CMEK) for all storage services.

Question 6

Which TWO organization policies can help enforce compliance with data residency requirements?

Accepted Answer

constraints/gcp.resourceLocations. Option C is correct because the `constraints/gcp.resourceLocations` organization policy restricts the physical location where Google Cloud resources (like Compute Engine instances, Cloud Storage buckets, and BigQuery datasets) can be created. By defining allowed locations (e.g., `in:us-central1` or `in:europe-west1`), you enforce data residency requirements, ensuring data remains within specific geographic boundaries to comply with regulations like GDPR or HIPAA.

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/iam.disableServiceAccountCreation

Answer

constraints/compute.requireShieldedVm

Question 7

A financial services company is migrating to Google Cloud and needs to meet SOX compliance. They have a production project containing a Cloud SQL instance with financial transactions. They must ensure that all database changes are logged, and logs are immutable for 7 years. They enabled Cloud Audit Logs for Cloud SQL and created a log sink to export Admin Activity logs to Cloud Storage. However, during a quarterly audit, the auditor cannot find logs for some SELECT queries that accessed sensitive columns. The company expected these SELECT queries to appear in audit logs because they enabled Data Access audit logs for Cloud SQL. You discover that the Data Access audit logs were enabled at the project level, but the log sink only exports Admin Activity logs. Additionally, auditors require that logs cannot be deleted before the retention period. What should you do?

Accepted Answer

Modify the log sink to include Data Access audit logs and update the Cloud Storage bucket to have a 7-year retention policy and object holds.. Option D is correct because the root cause is that the log sink is configured to export only Admin Activity logs, while the missing SELECT queries are Data Access audit logs. By modifying the log sink to include Data Access audit logs, those queries will be exported. Additionally, setting a 7-year retention policy and object holds on the Cloud Storage bucket ensures logs are immutable and cannot be deleted before the retention period ends, meeting SOX compliance requirements.

Answer

Enable VPC Flow Logs and export them to Cloud Storage with a 7-year retention policy.

Answer

Export logs to BigQuery with table expiration of 7 years and use IAM to restrict deletion.

Answer

Enable Data Access audit logs at the Cloud SQL instance level and export them to a separate Cloud Storage bucket with a 7-year retention policy.

Question 8

A healthcare startup is using Google Cloud to process Protected Health Information (PHI) for a clinical study. They are HIPAA-compliant and use Cloud Storage with CMEK. They also use BigQuery to run analytics on de-identified data. The security team notices that some PHI data appears in BigQuery query results. Upon investigation, they find that a data engineer created a BigQuery table that directly references the Cloud Storage bucket containing PHI without using the de-identification pipeline. The startup needs to prevent any direct access to Cloud Storage from BigQuery unless it goes through the pipeline. They also need to ensure that any new datasets are automatically subject to the same restrictions. What should they do?

Accepted Answer

Create a VPC Service Control perimeter around the pipeline project, and use an organization policy to require that Cloud Storage buckets be in a perimeter.. Option D is correct because VPC Service Controls create a security perimeter around the pipeline project, preventing data exfiltration and unauthorized access to Cloud Storage from BigQuery unless the request originates from within the perimeter. The organization policy requiring Cloud Storage buckets to be in a perimeter ensures that any new datasets are automatically subject to the same restrictions, enforcing the de-identification pipeline as the only allowed path.

Answer

Enable Access Transparency logs and set up alerts for any direct access to Cloud Storage.

Answer

Use DLP API to automatically de-identify data in Cloud Storage before BigQuery reads it.

Answer

Use IAM conditions to restrict access to the Cloud Storage bucket only from the service account used by the pipeline.

Question 9

A company in the EU is moving to Google Cloud and must comply with GDPR data residency requirements. They have users across multiple EU countries and want to ensure that personal data remains within the European Economic Area (EEA). They plan to use Cloud Storage, BigQuery, and Compute Engine. The security administrator sets organization policies to restrict resource locations to europe-west1, europe-west3, and europe-west4. After deploying applications, the compliance team finds that some data is stored in a Cloud Storage bucket in us-central1. Investigation shows that the bucket was created by a developer who manually chose the region. The organization policy seems to have been bypassed. The administrator confirms the policy is active and applied to the project. What is the most likely cause?

Accepted Answer

The organization policy was set at the folder level, and the project where the bucket was created is not a child of that folder.. Organization policies in Google Cloud are hierarchical and apply only to resources within the scope of the node (organization, folder, or project) where they are set. If the policy is set at a folder level, it does not affect projects that are not children of that folder. In this scenario, the bucket was created in a project outside the folder hierarchy where the policy was applied, so the policy was not enforced on that project, allowing the developer to choose us-central1.

Answer

The policy only applies to Compute Engine resources, not Cloud Storage.

Answer

The developer has the orgpolicy.policyCreator role, which allows them to bypass the policy.

Answer

The policy was set to allowlist mode, and us-central1 is in the allowlist.

Question 10

A multinational corporation must comply with GDPR requirements for storing and processing personal data of EU citizens. The company is using Google Cloud and wants to ensure that data remains within the European Union. Which TWO actions should the organization take? (Select TWO.)

Accepted Answer

Set up VPC Service Controls to block access from outside the EU.. Option A is correct because VPC Service Controls create a security perimeter around Google Cloud resources, allowing you to restrict data access based on attributes like IP address or geographic location. By configuring VPC Service Controls to block access from outside the EU, the organization can enforce that data stored and processed in Google Cloud remains within the European Union, directly supporting GDPR compliance for data residency.

Answer

Enable Access Transparency logs to monitor access by Google support personnel.

Answer

Use Cloud Data Loss Prevention (DLP) to automatically redact personal data before storage.

Answer

Use CMEK with a key stored in Cloud HSM located in a US region to encrypt data.

Question 11

A healthcare organization is deploying a new application on Google Cloud that will process protected health information (PHI) subject to HIPAA. The security team has enabled encryption at rest using Google-managed keys and configured Cloud Audit Logs. During a compliance review, the auditor notes that the organization has not yet signed a Business Associate Agreement (BAA) with Google Cloud. What should the organization do to remediate this issue?

Accepted Answer

Sign a BAA with Google Cloud through the Google Cloud Console or by contacting Google Cloud Support.. Under HIPAA, a covered entity or business associate must have a signed Business Associate Agreement (BAA) with any service provider that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. Google Cloud offers a standard BAA that customers must accept through the Google Cloud Console or by contacting support; encryption at rest and audit logs are separate technical controls that do not satisfy this contractual requirement. Option C is correct because signing a BAA is the only direct way to establish the legally required business associate relationship with Google Cloud for PHI processing.

Answer

Enable VPC Service Controls to satisfy HIPAA requirements without a BAA.

Answer

Use Customer-Managed Encryption Keys (CMEK) to meet the requirement for a signed BAA.

Answer

Configure Access Transparency logs as a substitute for a BAA.

Question 12

A financial services company is deploying a new payment processing system on Google Cloud that must comply with PCI DSS. The system processes credit card data. The security team has implemented encryption at rest and in transit, and uses Private Google Access for VPC communication. During a PCI assessment, the assessor points out that the company is missing a critical control: the need to regularly scan the external IP addresses of the VMs for vulnerabilities. What should the company do to address this requirement?

Accepted Answer

Set up a third-party vulnerability scanner (e.g., Nessus) from the Cloud Marketplace and run scans against external IPs.. Option D is correct because PCI DSS Requirement 11.2 mandates that external-facing IP addresses be scanned for vulnerabilities at least quarterly and after any significant change. Deploying a third-party scanner like Nessus from the Cloud Marketplace allows the company to run authenticated or unauthenticated scans against the external IPs of their VMs, meeting the specific requirement. Google Cloud does not provide a native active vulnerability scanning service for external IPs; Security Command Center Premium and Cloud IDS focus on asset discovery and threat detection, not active scanning of external endpoints.

Answer

Use Security Command Center Premium to perform vulnerability scanning.

Answer

Deploy Cloud IDS to perform active vulnerability scanning on external IPs.

Answer

Enable Cloud Armor to block all traffic and thus eliminate the need for scanning.

Question 13

A global e-commerce company is using Google Cloud to store customer data subject to GDPR. They have implemented data residency controls to keep data within the EU. However, during a routine audit, the compliance team discovers that some backups of customer data are being replicated to a US region due to a misconfigured backup policy. The data includes personal information. The company must ensure that all data remains within the EU. What should the team do to prevent this from recurring and remediate the current situation?

Accepted Answer

Use Organization Policies to enforce a constraint that disables the creation of resources outside the EU, and then delete the US backups.. Option C is correct because Organization Policies allow the company to enforce a resource location constraint (e.g., `constraints/gcp.resourceLocations`), which prevents the creation of any Google Cloud resources outside the EU. This proactively stops misconfigured backups from being replicated to non-EU regions. Deleting the US backups after applying the policy remediates the current GDPR violation by removing the non-compliant data.

Answer

Delete the backups in the US region immediately and reconfigure the backup policy to only use EU regions.

Answer

Enable Access Transparency for the US backups to monitor access.

Answer

Encrypt the US backups with CMEK and leave them in place, as encryption satisfies GDPR.

Question 14

A government agency is migrating to Google Cloud and must comply with FedRAMP requirements. They need to ensure that only FedRAMP authorized Google Cloud services are used in their project. The security team has enabled Organization Policies and created a custom policy to restrict allowed services to a specific list. However, when a developer tries to create a Cloud SQL instance, the operation is denied. The developer receives an error: 'The organization policy constraint compute.restrictNonPdServices is not allowing this resource.' The developer is trying to create a Cloud SQL instance, which is a FedRAMP authorized service. What is the most likely cause of the denial?

Accepted Answer

The organization policy is misconfigured and does not include Cloud SQL in the allowed list.. The error message explicitly references the `compute.restrictNonPdServices` organization policy constraint, which is used to restrict the creation of non-Persistent Disk (PD) services. The developer's attempt to create a Cloud SQL instance is denied because the custom policy's allowed list does not include Cloud SQL, even though it is a FedRAMP authorized service. The policy must be updated to include Cloud SQL in the allowed services list for the operation to succeed.

Answer

Cloud SQL instances require a specific region that is not permitted by the policy.

Answer

The developer does not have the necessary IAM permissions to create Cloud SQL instances.

Answer

The organization policy is blocking all services not in a specific list, and Cloud SQL is not included because it is a data service rather than a compute service.

Question 15

A large healthcare organization is migrating its on-premises data center to Google Cloud. The organization must comply with HIPAA and has signed a BAA with Google Cloud. They plan to use BigQuery for analytics on PHI data. The security team has enabled encryption at rest with CMEK and has configured VPC Service Controls to prevent data exfiltration. During a penetration test, the testers discovered that they could query the BigQuery dataset using a service account that has BigQuery Data Viewer role from a non-VPC-SC-compliant network. This could allow unauthorized access to PHI data. The team needs to restrict all access to the BigQuery dataset to only originate from within the VPC perimeter defined by VPC Service Controls. What should the team do to enforce this requirement?

Accepted Answer

Enable VPC Service Controls perimeters for the BigQuery API and ensure that the project containing the dataset is in the perimeter, and configure ingress/egress rules to allow only requests from within the perimeter.. Option C is correct because VPC Service Controls are specifically designed to create a security perimeter around Google Cloud services like BigQuery, preventing data exfiltration and restricting access to only requests originating from within the defined perimeter. By placing the project containing the BigQuery dataset inside the VPC Service Controls perimeter and configuring ingress/egress rules, the team ensures that even a service account with BigQuery Data Viewer role cannot query the dataset from a non-VPC-SC-compliant network, as the API call is blocked at the Google Cloud edge before it reaches BigQuery.

Answer

Set up Private Google Access for the on-premises network and route all traffic through a VPN tunnel.

Answer

Configure an Organization Policy that restricts BigQuery access to only service accounts with a specific prefix.

Answer

Use Cloud IAP to require users to authenticate before accessing BigQuery.