PCSE Ensuring data protection — 50 Questions

Question 1

A company stores sensitive customer data in Cloud Storage. They want to ensure that data is encrypted at rest using customer-managed encryption keys (CMEK) and that access to the key is audited. Which approach should they use?

Accepted Answer

Use CMEK with a Cloud KMS key and enable Cloud Audit Logs for the key.. Option D is correct because it combines customer-managed encryption keys (CMEK) via Cloud KMS with Cloud Audit Logs enabled on the key itself. This ensures the data is encrypted at rest using a key that the customer controls and rotates, and all operations against that key (e.g., encrypt, decrypt, enable, disable) are logged for auditing. Cloud Audit Logs on the bucket alone would not capture key access events, which is required for full auditability.

Answer

Use Google-managed encryption keys and enable Cloud Audit Logs for the bucket.

Answer

Use CMEK with key material stored in a Cloud Storage bucket.

Answer

Use customer-supplied encryption keys (CSEK) and store the keys in Secret Manager.

Question 2

A security engineer needs to protect sensitive data in BigQuery. The data includes columns with personally identifiable information (PII). They want to automatically mask PII data for users with the role 'analyst' but allow full access for 'admin' users. Which approach should they use?

Accepted Answer

Apply policy tags with data masking policies to PII columns and assign the tag to the analyst role.. Option D is correct because BigQuery's policy tags with data masking policies allow you to automatically mask sensitive columns (e.g., PII) at query time based on the user's role. You assign a masking policy to the policy tag, then attach that tag to the PII columns. By granting the 'analyst' role access to the tag with the masking rule applied, analysts see masked data, while 'admin' users (who have higher-level IAM permissions) see the full data without additional configuration.

Answer

Use VPC Service Controls to restrict access to the dataset.

Answer

Create authorized views that exclude PII columns for the analyst role.

Answer

Use column-level access control via IAM roles to deny access to PII columns for analysts.

Question 3

A company is using Cloud SQL for MySQL to store financial data. They need to ensure that all data is encrypted at rest and in transit. What should they do?

Accepted Answer

Use the default encryption provided by Cloud SQL and enforce SSL/TLS connections.. Option D is correct because Cloud SQL for MySQL automatically encrypts data at rest using AES-256, with no additional configuration required. To protect data in transit, you must enforce SSL/TLS connections by configuring the instance to require SSL and downloading the server certificate for client connections. This combination satisfies both encryption requirements without unnecessary complexity.

Answer

Use client-side encryption before storing data in Cloud SQL.

Answer

Enable encryption at rest by checking a box in the Cloud Console.

Answer

Enable CMEK on the Cloud SQL instance and configure SSL/TLS.

Question 4

A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.. Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.

Answer

Use Cloud HSM to create and manage keys.

Answer

Use customer-supplied encryption keys (CSEK) for each object.

Answer

Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.

Question 5

A company has a Cloud Storage bucket containing sensitive data. They want to ensure that only users with specific IAM roles can access the bucket, and that access is logged for audit purposes. They also want to prevent public access. Which configuration steps should they take?

Accepted Answer

Enable uniform bucket-level access, set IAM policies, and enable Cloud Audit Logs.. Option C is correct because enabling uniform bucket-level access disables ACLs, forcing all access decisions to be made by IAM policies alone, which simplifies permission management and prevents public access. Setting IAM policies ensures only users with specific roles can access the bucket, and enabling Cloud Audit Logs captures all access requests for audit purposes. This combination meets all requirements: no public access, role-based access control, and logging.

Answer

Use IAM roles only and enable Cloud Audit Logs, but keep ACLs enabled.

Answer

Use VPC Service Controls and enable Cloud Audit Logs.

Answer

Enable fine-grained access using ACLs and enable Cloud Audit Logs.

Question 6

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Accepted Answer

Use the DLP API to inspect the storage for sensitive data.. Option B is correct because the DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Answer

Create custom infoTypes for all sensitive data.

Answer

Store de-identification templates in Cloud KMS.

Answer

Use VPC Service Controls to restrict access to the data.

Question 7

A company uses BigQuery to store sensitive data and wants to implement data masking using policy tags. They have three user groups: data_engineers (full access), data_analysts (masked PII), and data_scientists (masked financial data). Which THREE steps should they take?

Accepted Answer

Publish the taxonomy to make the policy tags available for use.. Option A is correct because after creating a taxonomy with policy tags in Cloud Data Catalog, you must publish the taxonomy to make those policy tags available for use in BigQuery. Publishing associates the taxonomy with the project and allows BigQuery to enforce data masking rules based on the policy tags applied to columns.

Answer

Apply only one policy tag per column.

Answer

Enable Cloud Audit Logs to track policy tag usage.

Question 8

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Accepted Answer

The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.. The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Answer

The key ring 'my-keyring' does not exist.

Answer

The key ring location is incorrect.

Answer

The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.

Question 9

A security engineer reviews the IAM policy for a Cloud Storage bucket as shown in the exhibit. Alice reports that she cannot upload objects to the bucket, while Bob can view objects. What is the most likely issue?

Accepted Answer

The bucket has ACLs that deny Alice upload access.. Option A is correct because Cloud Storage buckets can have both IAM policies and Access Control Lists (ACLs) applied. If the bucket's ACL explicitly denies Alice the `WRITER` or `OWNER` permission, she will be unable to upload objects even if her IAM policy grants broader roles. Bob can view objects because his IAM role (e.g., `roles/storage.objectViewer`) is not overridden by a conflicting ACL, or his ACL entry grants `READER` access.

Answer

Alice has the objectViewer role but not the objectAdmin role.

Answer

Alice does not have the storage.buckets.getIamPolicy permission.

Answer

The objectAdmin role does not include the storage.objects.create permission.

Question 10

A company stores sensitive customer data in Cloud Storage and uses CMEK with Cloud KMS. They want to ensure that data in transit to the storage bucket is always encrypted using TLS 1.2 or higher. Which configuration should they implement?

Accepted Answer

Set the bucket's 'requireTls' transport security setting to 'true' in the bucket's IAM policy.. Option B is correct because setting the bucket's 'requireTls' transport security setting to 'true' in the bucket's IAM policy enforces that all requests to the bucket must use TLS 1.2 or higher. This is a bucket-level policy condition that directly controls the encryption of data in transit, ensuring that any HTTP request without TLS 1.2+ is denied.

Answer

Use Cloud Armor to enforce HTTPS with a TLS 1.2 minimum.

Answer

Configure the bucket to use CMEK with a key from Cloud HSM.

Answer

Add a bucket policy that denies requests with 'sslEnabled' set to 'false'.

Question 11

A healthcare organization stores PHI in BigQuery tables with row-level access policies. They need to ensure that data is automatically de-identified when exported to Cloud Storage for analytics. What is the most scalable solution with minimal manual intervention?

Accepted Answer

Use BigQuery data masking to define de-identification policies, then export the masked data directly.. Option D is correct because BigQuery data masking allows you to define column-level de-identification policies that are applied automatically at query time. When you export the masked data directly using an export job, the de-identification is enforced without additional scripting or post-processing, making it the most scalable and low-maintenance solution for PHI protection.

Answer

Set up VPC Service Controls to prevent data exfiltration and rely on access controls.

Answer

Create a scheduled query in BigQuery that exports data using a view with de-identification functions.

Answer

Use Cloud DLP API to scan and de-identify the export file after it is written to Cloud Storage.

Question 12

A company uses Cloud KMS to protect encryption keys for their Cloud SQL databases. They want to rotate keys every 30 days and ensure that old keys are retained for at least 90 days. What is the recommended approach?

Accepted Answer

Use a Cloud KMS key with automatic rotation period of 30 days and disable old key versions after 90 days.. Option C is correct because Cloud KMS supports automatic key rotation with a configurable period (e.g., 30 days), which creates new key versions automatically. To meet the 90-day retention requirement, you can disable old key versions after 90 days using the key version lifecycle policy, ensuring they are not used for encryption but remain available for decryption of older data.

Answer

Use a Cloud KMS key with manual rotation every 30 days and keep all key versions indefinitely.

Answer

Use Cloud HSM to generate a key and set key version lifecycle to disable after 90 days.

Answer

Use customer-supplied encryption keys (CSEK) and rotate them manually.

Question 13

Which TWO actions should a security engineer take to protect sensitive data in Cloud Storage buckets from accidental public exposure? (Choose two.)

Accepted Answer

Set the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' to enforce uniform bucket-level access across the organization.. Option B is correct because setting the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' enforces uniform bucket-level access across the organization, preventing the use of fine-grained ACLs that can accidentally expose data. This policy ensures that all new buckets default to IAM-based access control, reducing the risk of misconfigured public ACLs.

Answer

Use Cloud Data Loss Prevention (DLP) to scan buckets for public access.

Answer

Configure VPC Service Controls to restrict access to the buckets from within the VPC.

Answer

Enable bucket lock on all buckets to prevent deletion of objects.

Question 14

Which THREE steps are required to implement field-level encryption for sensitive columns in a Cloud SQL for PostgreSQL database using Cloud KMS? (Choose three.)

Accepted Answer

Create a symmetric encryption key in Cloud KMS.. Option A is correct because Cloud KMS symmetric encryption keys are used to encrypt data encryption keys (DEKs) that protect the column data. In field-level encryption, the application or database encrypts each column value using a DEK, which is then wrapped (encrypted) by a Cloud KMS key. This ensures the sensitive data is encrypted at the application layer, independent of the underlying storage encryption.

Answer

Configure a Cloud HSM key to generate the data encryption key.

Answer

Enable CMEK on the Cloud SQL instance.

Question 15

Refer to the exhibit. A security engineer runs this command to check bucket permissions. What is the most significant security issue?

Accepted Answer

The bucket allows public read access via 'allUsers' in both ACL and legacy role.. Option C is correct because the command output shows that the bucket has both an ACL granting 'allUsers' READER access and a legacy bucket role 'roles/storage.legacyBucketReader' assigned to 'allUsers'. This means the bucket is publicly readable via two independent mechanisms, which is the most significant security issue as it exposes all objects to the internet without authentication.

Answer

The domain example.com has viewer access, which may be too broad.

Answer

The legacy role 'roles/storage.legacyBucketReader' is used.

Answer

Uniform bucket-level access is disabled, allowing ACLs.

Question 16

You are a security engineer for a healthcare organization. You need to protect sensitive patient data stored in Cloud Storage. You want to ensure that data is encrypted at rest using a customer-managed key (CMEK) and that access to the key is logged. You also need to prevent data exfiltration by limiting which service accounts can decrypt data. Which TWO steps should you take? (Choose two.)

Accepted Answer

Configure a VPC Service Controls perimeter that includes the Cloud Storage bucket and the KMS key.. Option A is correct because VPC Service Controls creates a security perimeter around the Cloud Storage bucket and the KMS key, preventing data exfiltration by blocking unauthorized service accounts from decrypting data outside the perimeter. Option E is correct because creating a Cloud KMS key ring and key, configuring the bucket to use CMEK, and enabling Cloud Audit Logs for the KMS key ensures encryption at rest with a customer-managed key and logs all access to the key, meeting both requirements.

Answer

Use Cloud HSM to create and manage the encryption key, and disable Cloud Audit Logs for the HSM key.

Answer

Enable default encryption (Google-managed key) on the bucket and use Cloud Audit Logs to monitor access.

Answer

Use customer-supplied encryption keys (CSEK) and store the key in Cloud Key Management Service (KMS).

Question 17

Refer to the exhibit. You are analyzing the IAM policy for a project. You need to ensure that only authenticated users can access objects in bucket1 under the prefix "reports/". Which of the following statements is correct?

Accepted Answer

Bob can view, create, and delete any object in bucket1.. Option C is correct because the IAM policy grants Bob the roles/storage.objectAdmin role on the entire bucket1, which includes permissions to view, create, and delete any object in the bucket. The condition restricting access to the "reports/" prefix applies only to the objectViewer role, not to Bob's role. Therefore, Bob has full administrative access to all objects in bucket1 without any prefix restriction.

Answer

The condition on objectViewer also prevents alice from listing objects under reports/.

Answer

The service account sa-1 can view objects under reports/ in bucket1.

Answer

Alice can only view objects under reports/ in bucket1.

Question 18

Your company runs a data analytics platform on Google Cloud that processes sensitive financial data. Data is ingested from various sources into a Cloud Storage bucket, then processed by Dataflow jobs, and final results are stored in BigQuery. You have implemented the following security controls:
- VPC Service Controls perimeter around the project
- Cloud KMS CMEK for all storage services
- IAM conditions restricting access based on tags
- Cloud Audit Logs enabled for all services

Recently, an auditor discovered that a compromised service account was able to read data from the Cloud Storage bucket even though it was outside the VPC Service Controls perimeter. The auditor reviewed the logs and found that the access came from a Compute Engine instance that was running within the same project. What is the most likely reason the VPC Service Controls perimeter did not block this access?

Accepted Answer

The VPC Service Controls perimeter allows access from resources within the same project, even if they are outside the perimeter.. VPC Service Controls perimeters are designed to prevent data exfiltration by blocking access from networks outside the perimeter, but they explicitly allow access from resources within the same project, even if those resources are not inside the perimeter. In this scenario, the compromised service account was used by a Compute Engine instance running in the same project, so the access was permitted by design. This is a known behavior: VPC Service Controls do not restrict access between resources that share the same Google Cloud project, regardless of whether the requesting resource is inside or outside the perimeter.

Answer

The Cloud KMS key used for encryption was not bound to the perimeter.

Answer

The Cloud Audit Logs were not enabled for the Cloud Storage bucket, so the access was not logged.

Answer

The VPC Service Controls perimeter was not configured to include the Cloud Storage bucket.

Question 19

Drag and drop the steps to rotate a customer-managed encryption key (CMEK) in Cloud KMS in the correct order.

Question 20

Drag and drop the steps to configure a security scanner to scan a web application in the correct order.