PCSE Ensuring data protection Practice Test 2 — 15 Questions

Question 1

You are a security engineer for a healthcare organization. You need to protect sensitive patient data stored in Cloud Storage. You want to ensure that data is encrypted at rest using a customer-managed key (CMEK) and that access to the key is logged. You also need to prevent data exfiltration by limiting which service accounts can decrypt data. Which TWO steps should you take? (Choose two.)

Accepted Answer

Configure a VPC Service Controls perimeter that includes the Cloud Storage bucket and the KMS key.. Option A is correct because VPC Service Controls creates a security perimeter around the Cloud Storage bucket and the KMS key, preventing data exfiltration by blocking unauthorized service accounts from decrypting data outside the perimeter. Option E is correct because creating a Cloud KMS key ring and key, configuring the bucket to use CMEK, and enabling Cloud Audit Logs for the KMS key ensures encryption at rest with a customer-managed key and logs all access to the key, meeting both requirements.

Answer

Use Cloud HSM to create and manage the encryption key, and disable Cloud Audit Logs for the HSM key.

Answer

Enable default encryption (Google-managed key) on the bucket and use Cloud Audit Logs to monitor access.

Answer

Use customer-supplied encryption keys (CSEK) and store the key in Cloud Key Management Service (KMS).

Question 2

Refer to the exhibit. You are analyzing the IAM policy for a project. You need to ensure that only authenticated users can access objects in bucket1 under the prefix "reports/". Which of the following statements is correct?

Accepted Answer

Bob can view, create, and delete any object in bucket1.. Option C is correct because the IAM policy grants Bob the roles/storage.objectAdmin role on the entire bucket1, which includes permissions to view, create, and delete any object in the bucket. The condition restricting access to the "reports/" prefix applies only to the objectViewer role, not to Bob's role. Therefore, Bob has full administrative access to all objects in bucket1 without any prefix restriction.

Answer

The condition on objectViewer also prevents alice from listing objects under reports/.

Answer

The service account sa-1 can view objects under reports/ in bucket1.

Answer

Alice can only view objects under reports/ in bucket1.

Question 3

Your company runs a data analytics platform on Google Cloud that processes sensitive financial data. Data is ingested from various sources into a Cloud Storage bucket, then processed by Dataflow jobs, and final results are stored in BigQuery. You have implemented the following security controls:
- VPC Service Controls perimeter around the project
- Cloud KMS CMEK for all storage services
- IAM conditions restricting access based on tags
- Cloud Audit Logs enabled for all services

Recently, an auditor discovered that a compromised service account was able to read data from the Cloud Storage bucket even though it was outside the VPC Service Controls perimeter. The auditor reviewed the logs and found that the access came from a Compute Engine instance that was running within the same project. What is the most likely reason the VPC Service Controls perimeter did not block this access?

Accepted Answer

The VPC Service Controls perimeter allows access from resources within the same project, even if they are outside the perimeter.. VPC Service Controls perimeters are designed to prevent data exfiltration by blocking access from networks outside the perimeter, but they explicitly allow access from resources within the same project, even if those resources are not inside the perimeter. In this scenario, the compromised service account was used by a Compute Engine instance running in the same project, so the access was permitted by design. This is a known behavior: VPC Service Controls do not restrict access between resources that share the same Google Cloud project, regardless of whether the requesting resource is inside or outside the perimeter.

Answer

The Cloud KMS key used for encryption was not bound to the perimeter.

Answer

The Cloud Audit Logs were not enabled for the Cloud Storage bucket, so the access was not logged.

Answer

The VPC Service Controls perimeter was not configured to include the Cloud Storage bucket.

Question 4

Drag and drop the steps to rotate a customer-managed encryption key (CMEK) in Cloud KMS in the correct order.

Question 5

Drag and drop the steps to configure a security scanner to scan a web application in the correct order.

Question 6

Match each CVE or security concept to its description.

Question 7

Match each access control mechanism to its description.

Question 8

A company stores sensitive customer data in Cloud Storage. They want to ensure that only users with explicit IAM permissions can decrypt the data, and that Google does not have access to the encryption keys. Which encryption option should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-supplied encryption keys (CSEK) allow you to provide your own encryption keys, which are used to protect data at rest in Cloud Storage. Google does not store these keys on its servers; they are used only transiently during encryption/decryption operations and then discarded, ensuring that Google cannot access the keys or the decrypted data. This meets the requirement that only users with explicit IAM permissions can decrypt the data, as access to the CSEK must be granted through IAM roles like Storage Object Viewer with the CSEK key.

Answer

Customer-managed encryption keys (CMEK)

Answer

Google-managed encryption keys (GMEK)

Answer

Default encryption

Question 9

A security engineer needs to audit all attempts to access a Cloud Storage bucket, including successful and failed attempts. Which logging option should they enable?

Accepted Answer

Cloud Audit Logs with Data Access. Cloud Audit Logs with Data Access logs capture read/write operations on data. Admin Read logs only record configuration changes, not data access. Cloud Monitoring is for metrics, not logs. VPC Flow Logs are for network traffic, not object-level access.

Answer

Cloud Audit Logs with Admin Read

Answer

Cloud Monitoring with uptime checks

Answer

VPC Flow Logs

Question 10

An organization wants to prevent data exfiltration from a Google Cloud project by restricting the copying of data from Cloud Storage to external IPs. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls (C) is correct because it allows you to define security perimeters around Google Cloud services like Cloud Storage, preventing data exfiltration by blocking access from external IPs. By creating a service perimeter, you can enforce that data can only be accessed from within a specified VPC network or on-premises network via Private Google Access, effectively restricting copying to external IP addresses.

Answer

Cloud Armor

Answer

IAM

Answer

Cloud Data Loss Prevention (DLP)

Question 11

A company uses BigQuery to store analytics data. They need to restrict access to specific rows based on the user's department. What should they implement?

Accepted Answer

Row-level security using authorized views. Authorized views in BigQuery can filter rows based on the user's identity or other context. Column-level security is for columns, not rows. IAM conditions cannot restrict rows. Data Catalog is for metadata.

Answer

Column-level security

Answer

Data Catalog tags

Answer

IAM conditions on BigQuery datasets

Question 12

A financial institution uses Cloud KMS to manage encryption keys. They want to ensure that key material is never exported from the KMS service. Which key protection method should they use?

Accepted Answer

HSM keys in Cloud KMS. Option C is correct because HSM keys in Cloud KMS are generated and stored within a FIPS 140-2 Level 3 certified hardware security module (HSM) that is physically and logically controlled by Google. The key material never leaves the HSM boundary; all cryptographic operations are performed inside the HSM, and export of the key material is prevented by design. This satisfies the requirement that key material is never exported from the KMS service.

Answer

Cloud HSM

Answer

External key manager

Answer

Software keys in Cloud KMS

Question 13

A healthcare organization stores Protected Health Information (PHI) in Cloud Storage. They need to de-identify data before sharing it with researchers. Which service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and de-identify sensitive data such as Protected Health Information (PHI). It uses built-in infoTypes (e.g., US_INDIVIDUAL_HEALTHCARE_NPI) and de-identification techniques like masking, tokenization, and redaction to transform PHI into a de-identified dataset before sharing with researchers, ensuring compliance with HIPAA.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud IAM

Question 14

A company uses Cloud SQL for MySQL with automated backups. They want to ensure that backup data is encrypted with a key that they manage and rotate on a schedule, separate from the primary database encryption. What should they do?

Accepted Answer

Use Cloud SQL's backup encryption with customer-managed key by specifying a CMEK for backups.. Cloud SQL allows enabling CMEK for backups separately by specifying a different CMEK key for backup encryption. Enabling CMEK on the instance encrypts both data and backups with the same key. Exporting to Cloud Storage is not automated.

Answer

Enable CMEK on the Cloud SQL instance, which automatically encrypts backups with the same key.

Answer

Use CSEK for the Cloud SQL instance and then re-encrypt backups.

Answer

Export backups to Cloud Storage and apply CMEK on the export bucket.

Question 15

An organization uses BigQuery with column-level security. They have a column containing social security numbers (SSNs) that should only be visible to users with the 'PII_Viewer' role. How should they configure this?

Accepted Answer

Create a policy tag on the column and bind it to the role.. Option D is correct because BigQuery column-level security uses policy tags to restrict access to sensitive columns. By creating a policy tag on the SSN column and binding it to the 'PII_Viewer' role, only users with that role can see the data; others see NULL or are denied access. This is the native, recommended approach for column-level access control in BigQuery.

Answer

Encrypt the column with CMEK and give decrypt permission only to PII_Viewer.

Answer

Use authorized views to filter the column.

Answer

Use BigQuery row-level access policies.