PCSE Ensuring data protection Practice Test 4 — 15 Questions

Question 1

A healthcare organization is designing a data pipeline that ingests patient health records into Cloud Storage, then processes them with Dataflow for analytics. They must ensure that data is encrypted at rest and in transit, and that only authorized users can access the raw data. They also need to guarantee that the encryption keys are stored outside of Google Cloud. Which solution meets all requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with a partner key manager.. Cloud EKM allows you to manage encryption keys using a supported external key management partner, ensuring keys are stored outside Google Cloud. This meets the requirement for encryption at rest and in transit (Dataflow and Cloud Storage use these keys transparently) while keeping key material external to Google's infrastructure. Only authorized users can access raw data via IAM and the external key manager's access controls.

Answer

Use default encryption and rely on Google's data residency commitments.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for Cloud Storage and Dataflow.

Answer

Use Cloud HSM to generate and store keys.

Question 2

Which two Cloud Storage encryption options allow the customer to supply or manage the encryption keys? (Choose two.)

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow you to supply your own encryption keys for protecting data at rest in Cloud Storage. With CSEK, you provide the key material for each API call, and Google does not store the key on its servers. This option is correct because the customer directly supplies the encryption key.

Answer

Default encryption at rest

Answer

Google-managed encryption keys

Answer

Cloud HSM keys

Question 3

Which three actions help protect Cloud KMS key material? (Choose three.)

Accepted Answer

Use VPC Service Controls to restrict access to the key.. B is correct because VPC Service Controls create a security perimeter around Cloud KMS resources, preventing data exfiltration by restricting access to the key material from unauthorized networks or projects. This helps protect the key material even if an attacker gains credentials to the key, as the request must originate from within the allowed VPC scope.

Answer

Store the key in an HSM cluster.

Answer

Assign the Cloud KMS Admin role to all developers.

Question 4

Which two best practices for managing secrets in Secret Manager? (Choose two.)

Accepted Answer

Enable automatic replication to multiple regions for high availability.. Option A is correct because Secret Manager supports automatic replication across regions, ensuring that secret data remains available even during a regional outage. This is a key best practice for high availability and disaster recovery, as it allows applications to read secrets from the nearest or alternate region without manual intervention.

Answer

Use the Secret Manager API to list all secrets for any user.

Answer

Set a short TTL for secret versions and delete them immediately.

Answer

Store secrets in multiple ConfigMaps for redundancy.

Question 5

Refer to the exhibit. A security engineer has created this IAM policy for a Cloud KMS key. The service account my-sa is used by a Compute Engine VM to encrypt data before storing it in Cloud Storage. User alice needs to decrypt the data for analysis. Which statement is true?

Accepted Answer

The service account can encrypt but cannot decrypt.. The IAM policy grants the service account my-sa the Cloud KMS CryptoKey Encrypter role, which allows it to encrypt but not decrypt. User alice is granted the Cloud KMS CryptoKey Decrypter role, which allows her to decrypt but not encrypt. Therefore, the service account can only encrypt, and user alice can only decrypt, making option C correct.

Answer

User alice can both encrypt and decrypt.

Answer

User alice needs the Cloud KMS CryptoKeyEncrypter role to encrypt.

Answer

The service account can both encrypt and decrypt.

Question 6

Refer to the exhibit. Based on the exhibit, the corporate security policy requires that all Cloud KMS symmetric keys have automatic rotation enabled. Which statement is true?

Accepted Answer

Only the encryption-key is compliant.. The corporate security policy requires automatic rotation for all Cloud KMS symmetric keys. In the exhibit, the 'encryption-key' has automatic rotation enabled (as indicated by the rotation period being set), while the 'decryption-key' does not have automatic rotation enabled (rotation period is not set or is disabled). Therefore, only the encryption-key is compliant with the policy.

Answer

Both keys are compliant.

Answer

Neither key is compliant.

Answer

Only the decryption-key is compliant.

Question 7

Refer to the exhibit. A security engineer needs to ensure that all objects uploaded to the bucket are automatically encrypted with the specified KMS key. They also need to preserve older versions of objects. Which statement accurately describes the bucket configuration?

Accepted Answer

The bucket has default KMS encryption and versioning is enabled.. Option A is correct because the question requires both automatic encryption of all uploaded objects using a specified KMS key and preservation of older object versions. Default KMS encryption ensures that any object uploaded without explicit encryption headers is automatically encrypted with the configured KMS key, while enabling versioning allows the bucket to retain noncurrent object versions. Together, these settings meet both requirements.

Answer

The bucket has default KMS encryption but versioning is disabled.

Answer

The bucket uses CSEK and versioning is enabled.

Answer

The bucket uses Google-managed encryption and versioning is disabled.

Question 8

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted with a customer-managed key (CMEK) that is managed in Cloud KMS. The security team requires that only authorized applications can access the key. Which configuration step should be taken to achieve this?

Accepted Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the Cloud KMS key resource.. Option B is correct because Cloud Storage uses its own Google-managed service account to interact with Cloud KMS when encrypting or decrypting data with a CMEK. By granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the specific key resource, you authorize only that service account to use the key, ensuring that only authorized applications (via Cloud Storage) can access the key. This follows the principle of least privilege and meets the security team's requirement.

Answer

Use a customer-supplied encryption key (CSEK) instead of CMEK.

Answer

Create a bucket with default encryption set to use a CMEK, and grant the service account the Cloud KMS Admin role.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the project level.

Question 9

A company uses Cloud Data Loss Prevention (DLP) to inspect sensitive data in Cloud Storage. They want to automatically redact credit card numbers found in text files before the files are accessed by downstream applications. Which DLP method should be used?

Accepted Answer

Use the DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType`.. Option A is correct because the DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType` is designed to automatically replace sensitive data (like credit card numbers) with their corresponding info type labels (e.g., `[CREDIT_CARD_NUMBER]`) in text files. This method operates on content in memory or from Cloud Storage, enabling automated redaction before downstream access, without requiring a separate job or manual intervention.

Answer

Create a DLP job that uses the InspectJobConfig with a redact transformation.

Answer

Use Cloud DLP's inspect-only functionality and manually redact.

Answer

Set up a DLP inspection scan on the bucket with a `CryptoReplaceFfxFpe` transformation.

Question 10

A multinational organization must store customer data only in specific geographic regions to comply with data residency regulations. They use Cloud Spanner for their primary database. What should they do to enforce that data is stored only in approved regions?

Accepted Answer

Apply an organization policy with a constraint that restricts the location of Cloud Spanner resources to approved regions.. Organization policies with resource location constraints allow you to enforce that Cloud Spanner instances are created only in approved geographic regions. This policy is evaluated at resource creation time and prevents the deployment of Spanner instances outside the specified regions, directly addressing data residency compliance requirements.

Answer

Create a Cloud Spanner instance in the desired region and configure a backup in a different region for disaster recovery.

Answer

Configure a VPC Service Controls perimeter to restrict access to Cloud Spanner.

Answer

Use Cloud Spanner with data residency constraints by selecting a multi-region configuration that includes only approved regions.

Question 11

A security engineer needs to encrypt data at rest in Cloud Storage using a key that is not managed by Google Cloud. The key must be stored on-premises and provided with each API call for data access. Which encryption approach should be used?

Accepted Answer

Use customer-supplied encryption keys (CSEK) by providing the key in the request headers.. Customer-supplied encryption keys (CSEK) allow you to provide your own AES-256 key with each API call to Cloud Storage. The key is not stored by Google Cloud; it is used only in memory to encrypt/decrypt data and then discarded, meeting the requirement of on-premises key storage and per-API-call key provision.

Answer

Use customer-managed encryption keys (CMEK) with key material imported from an on-premises HSM.

Answer

Use Cloud KMS with a key stored in an on-premises HSM via Cloud External Key Manager.

Answer

Use Google-managed encryption keys with an organizational policy to disable automatic encryption.

Question 12

A company uses VPC Service Controls to protect data in BigQuery and Cloud Storage. They need to allow a third-party application running outside the service perimeter to query BigQuery datasets within the perimeter. What should they configure?

Accepted Answer

Grant the third-party project access to the perimeter via an access level.. Option B is correct because VPC Service Controls use access levels to define which client identities, IP addresses, or device characteristics are allowed to access protected resources from outside the service perimeter. By configuring an access level that includes the third-party application's project or IP range, the company can grant explicit, policy-based access to BigQuery datasets without removing the perimeter's data exfiltration protections.

Answer

Use private Google Access with a VPC network to allow the third-party.

Answer

Create a service perimeter bridge between the third-party project and the protected project.

Answer

Set up a VPC peering connection between the third-party VPC and the VPC hosting the resources.

Question 13

A financial institution uses Cloud HSM to protect cryptographic keys used for signing sensitive transactions. They want to ensure that keys are never exportable and that key usage is logged. Which key type should they create in Cloud HSM?

Accepted Answer

Purpose: ASYMMETRIC_SIGN with algorithm: RSA_SIGN_PKCS1_2048_SHA256. Option A is correct because Cloud HSM supports ASYMMETRIC_SIGN key purpose with RSA_SIGN_PKCS1_2048_SHA256, which creates a non-exportable key pair used for signing. Cloud HSM ensures the private key never leaves the HSM boundary, and all key usage is automatically logged via Cloud Audit Logs, meeting the requirements for non-exportability and logging.

Answer

Purpose: SYMMETRIC_ENCRYPT_DECRYPT with algorithm: GOOGLE_SYMMETRIC_ENCRYPTION

Answer

Purpose: ASYMMETRIC_DECRYPT with algorithm: RSA_DECRYPT_OAEP_2048_SHA256

Answer

Purpose: MAC with algorithm: HMAC_SHA256

Question 14

An organization uses Cloud DLP to scan a Cloud SQL database for PII. They want to automatically pseudonymize email addresses found in a specific column using a deterministic encryption that can be reversed for authorized users. The key must be stored in Cloud KMS. Which DLP transformation should they configure?

Accepted Answer

CryptoDeterministicConfig with a key from Cloud KMS.. Option B is correct because CryptoDeterministicConfig performs deterministic encryption (same plaintext always produces the same ciphertext) using a key from Cloud KMS, which allows pseudonymization that can be reversed by authorized users. This matches the requirement for a reversible, deterministic transformation on email addresses in a Cloud SQL column.

Answer

CryptoHashConfig with a cryptographic key from Cloud KMS.

Answer

CryptoReplaceFfxFpeConfig using a key from Cloud KMS.

Answer

ReplaceWithInfoTypeConfig with a cryptographic key.

Question 15

A security team has a Cloud KMS key used for encrypting Cloud Storage objects. They need to ensure that when the key is rotated, old data remains decryptable without manual re-encryption. They also want to minimize the number of key versions. Which approach should they take?

Accepted Answer

Use automatic rotation and keep one previous key version indefinitely.. Option B is correct because Cloud KMS supports automatic key rotation while retaining previous key versions indefinitely. When a key is rotated, new data is encrypted with the latest version, but old data remains decryptable using the previous key version that is kept. This satisfies the requirement of minimizing manual intervention and key version count, as only one previous version is retained.

Answer

Use automatic rotation and disable previous key versions after 30 days.

Answer

Use manual rotation and delete old key versions after confirmation that all data has been re-encrypted.

Answer

Use symmetric key with purpose SYMMETRIC_ENCRYPT_DECRYPT and set rotation period to 0 (never).