PCSE Ensuring data protection Practice Test 5 — 15 Questions

Question 1

A company needs to meet a regulatory requirement that cryptographic keys for data at rest in Google Cloud must be managed in an on-premises HSM and never leave the HSM. Google Cloud services should be able to use those keys for encryption/decryption. Which solution should they implement?

Accepted Answer

Use Cloud External Key Manager (EKM) to connect to the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use keys managed in a supported external key management system, such as an on-premises HSM, for Google Cloud services. The keys are used by Google Cloud for encryption and decryption but never leave the external HSM, satisfying the regulatory requirement that keys must remain on-premises.

Answer

Use Cloud HSM to protect keys imported from on-premises HSM.

Answer

Use Cloud KMS with automatic key rotation and store key versions on-premises.

Answer

Use customer-supplied encryption keys (CSEK) for each service.

Question 2

Which TWO of the following are valid methods to protect data in transit between on-premises and Google Cloud using Cloud VPN?

Accepted Answer

Use Cloud VPN with IPsec IKEv2.. Cloud VPN supports both IPsec IKEv1 and IKEv2 as valid protocols for establishing secure tunnels between on-premises networks and Google Cloud. IKEv2 offers improved stability and mobility support, but both are explicitly supported by Google Cloud VPN for protecting data in transit.

Answer

Use Cloud VPN with SSL VPN.

Answer

Use Cloud NAT for outbound traffic.

Answer

Use Cloud Interconnect with MACsec.

Question 3

Which THREE of the following are best practices for using Cloud DLP to protect sensitive data in BigQuery?

Accepted Answer

Use inspection jobs to scan tables and identify sensitive data.. Option A is correct because Cloud DLP inspection jobs can scan BigQuery tables to identify sensitive data types (e.g., PII, credit card numbers) using built-in infoTypes. This is a foundational step before applying any deidentification or access control measures, as it allows you to discover where sensitive data resides.

Answer

Store transformed data in a separate dataset with stricter access controls.

Answer

Encrypt the entire BigQuery table using CMEK.

Question 4

A company is implementing confidential VMs with Shielded VM and data encryption. Which two actions must be taken to ensure data protection for confidential compute workloads?

Accepted Answer

Use vTPM for key management.. Option A is correct because vTPM (virtual Trusted Platform Module) provides hardware-based key management for confidential VMs, enabling secure generation, storage, and attestation of encryption keys used for memory encryption and disk encryption. This ensures that only authorized code can access the keys, protecting data at rest and in use.

Answer

Use customer-managed encryption keys (CMEK) for persistent disk encryption.

Answer

Use a Confidential VM instance with an N2D machine series.

Answer

Use Cloud HSM to protect the encryption keys for the encrypted memory.

Question 5

Refer to the exhibit. A security engineer sees this configuration for a Cloud Storage bucket. What does this indicate about the encryption of objects in this bucket?

Accepted Answer

Objects are encrypted with a customer-managed key (CMEK) from Cloud KMS.. Option D is correct because the exhibit shows `kmsKeyName` set to a Cloud KMS key resource name (e.g., `projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`). This indicates the bucket is configured with a customer-managed encryption key (CMEK) from Cloud Key Management Service (Cloud KMS), meaning Google uses the specified key to encrypt/decrypt objects, and the customer controls key rotation and access via IAM.

Answer

Objects are encrypted with Google-managed keys, and the key name is the default.

Answer

Objects are encrypted with a customer-supplied key (CSEK).

Answer

Objects are encrypted with an external key from an on-premises HSM.

Question 6

Refer to the exhibit. A security engineer is reviewing a Cloud KMS key. What can be concluded about this key?

Accepted Answer

This key is stored in a Hardware Security Module (HSM) and cannot be exported.. The exhibit shows a Cloud KMS key with the purpose 'symmetric encryption' and the protection level 'HSM'. Keys with HSM protection level are stored in a Hardware Security Module, which provides tamper-resistant hardware-based key storage. Additionally, the key is marked as 'Cannot be exported', meaning the key material never leaves the HSM boundary, ensuring it cannot be extracted or copied. This matches the description of a key stored in an HSM that cannot be exported.

Answer

This key is a customer-managed encryption key (CMEK) but is stored in software.

Answer

This key is an external key managed via Cloud EKM.

Answer

This is a software key managed by Cloud KMS.

Question 7

Refer to the exhibit. An auditor notices this log entry. Which of the following is true about this event?

Accepted Answer

The service account has the Cloud KMS CryptoKey Decrypter role.. The log entry indicates a successful decryption operation ("decrypt" action with a success status). For a service account to successfully decrypt data using Cloud KMS, it must have the Cloud KMS CryptoKey Decrypter role (roles/cloudkms.cryptoKeyDecrypter) on the key. The log shows the caller is a service account, and the operation succeeded, confirming it has the necessary permissions. Option B correctly identifies this.

Answer

The decryption operation was performed on a key version that is disabled.

Answer

The decryption operation failed due to insufficient permissions.

Answer

The service account used is impersonating a user to decrypt data.

Question 8

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted at rest using a customer-managed key that is automatically rotated every 90 days. What should they do?

Accepted Answer

Create a Cloud KMS key ring and a key with rotation period set to 7776000s (90 days).. Option A is correct because Cloud KMS allows you to create a customer-managed encryption key (CMEK) with an automatic rotation period of 7776000 seconds (90 days). When you set the rotation period on a key, Cloud KMS automatically rotates the key material at the specified interval, ensuring that all data encrypted with that key is protected by a new key version without manual intervention. This satisfies the requirement for customer-managed keys with automatic rotation.

Answer

Use customer-supplied encryption keys (CSEK) and update them manually every 90 days.

Answer

Use default Google-managed encryption keys.

Answer

Use Cloud HSM to generate a key and implement a custom rotation script.

Question 9

A multinational organization must ensure that data for European users is stored only within the European Union to comply with GDPR. They use Cloud Storage and BigQuery. Which design should they implement?

Accepted Answer

Set an organization policy with constraints/gcp.resourceLocations to restrict resource creation to EU regions.. Option C is correct because the organization policy constraint `gcp/resourceLocations` is the only design that proactively prevents data from being stored outside the EU. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), any attempt to create a Cloud Storage bucket or BigQuery dataset in a non-EU region will be denied at the API level, ensuring GDPR compliance by design.

Answer

Use Cloud DLP to inspect and tag data for European origin.

Answer

Use VPC Service Controls to create a perimeter around European resources.

Answer

Use Cloud Armor with geo-based access control to restrict access from non-EU locations.

Question 10

A security engineer needs to configure Cloud KMS key rotation so that existing ciphertext can still be decrypted with old key versions, but new encryption uses the latest version. Which key management practice meets this requirement?

Accepted Answer

Set a rotation period on the key; Cloud KMS automatically creates new versions while old versions remain available for decryption.. Option A is correct because Cloud KMS supports key rotation by creating new key versions while retaining all previous versions. When you set a rotation period, Cloud KMS automatically generates a new version at the specified interval, and the key's primary version (used for new encryption) is updated. Old key versions remain enabled and available for decryption of existing ciphertext, ensuring that data encrypted with older versions can still be decrypted without manual intervention.

Answer

Use a single key and manually update its material every 90 days.

Answer

Create a new key version manually and disable the previous version after a grace period.

Answer

Create a new key every rotation and delete the old key after confirming re-encryption.

Question 11

A retail company hosts an e-commerce website on Compute Engine behind an HTTPS load balancer. They want to encrypt traffic between the load balancer and backend instances. What should they do?

Accepted Answer

Use an internal HTTPS load balancer and configure SSL certificates on backend services.. Option B is correct because an internal HTTPS load balancer in Google Cloud can terminate HTTPS from clients and re-encrypt traffic to backend instances using SSL certificates configured on the backend services. This ensures end-to-end encryption between the load balancer and backends, meeting the requirement to encrypt traffic in that segment.

Answer

Enable HTTPS only between clients and load balancer; backend traffic uses HTTP.

Answer

Apply Cloud Armor policy to enforce TLS between load balancer and backends.

Answer

Use Cloud VPN to connect load balancer to backend instances.

Question 12

A healthcare organization ingests patient data into Cloud Storage and then processes it with Dataflow. They need to de-identify sensitive fields like Social Security numbers before storing in BigQuery. Which approach should they use?

Accepted Answer

Use Cloud DLP to inspect and transform the data, then store the de-identified results in BigQuery.. Option B is correct because Cloud DLP inspection and transformation jobs can be integrated with BigQuery and Dataflow. Option A is wrong because BigQuery data masking only masks at query time, not at rest. Option C is wrong because Dataflow with custom code is more error-prone and harder to maintain. Option D is wrong because Cloud Data Catalog only catalogs but does not transform.

Answer

Use BigQuery column-level security with data masking.

Answer

Write custom Dataflow transformations using a Java SDK to redact SSNs.

Answer

Use Cloud Data Catalog to tag sensitive columns and rely on access control.

Question 13

A financial services company wants to ensure that Google Cloud staff cannot access their encryption keys or the plaintext data. They must meet regulatory requirements for data sovereignty. Which combination of services should they use?

Accepted Answer

Use Cloud External Key Manager and enable Access Transparency logs.. Option C is correct because Cloud External Key Manager (EKM) allows you to manage encryption keys using a supported external key management partner, ensuring that Google Cloud staff cannot access your keys or plaintext data. Enabling Access Transparency logs provides you with logs of Google Cloud staff access to your data, which helps meet regulatory requirements for data sovereignty by giving you visibility into administrative actions.

Answer

Use CMEK with Cloud HSM and disable Access Transparency.

Answer

Use Customer-Supplied Encryption Keys (CSEK) without Access Transparency.

Answer

Use VPC Service Controls and Cloud DLP.

Question 14

A small business stores backup archives in Cloud Storage and wants to encrypt them at rest using a key that is automatically rotated annually. They do not want to manage key material themselves. Which encryption option should they use?

Accepted Answer

Use Google-managed encryption keys (GMEK).. Option A is correct because Google-managed encryption keys (GMEK) are automatically rotated and require no customer management. Option B is wrong because CMEK requires customer management. Option C is wrong because CSEK requires the customer to supply and manage keys. Option D is wrong because client-side encryption is not handled by Google.

Answer

Use Cloud KMS customer-managed keys (CMEK) with rotation period.

Answer

Use Customer-Supplied Encryption Keys (CSEK).

Answer

Use client-side encryption with a third-party key management service.

Question 15

A company uses Cloud Functions to process employee data and wants to ensure that personally identifiable information (PII) is redacted from log output. Which approach should they take?

Accepted Answer

Use Cloud DLP API to inspect and redact the log message before writing to Cloud Logging.. Option B is correct because the Cloud DLP API can be integrated directly into a Cloud Function to inspect and redact PII from log messages before they are written to Cloud Logging. This ensures that sensitive data never appears in the logs, which is the most secure approach. Using Cloud DLP at the point of log generation prevents any exposure, rather than relying on post-hoc analysis or filtering.

Answer

Use Cloud Audit Logs to capture all access and redact at analysis.

Answer

Create a Logging sink with an exclusion filter to drop logs containing PII.

Answer

Enable VPC Service Controls to prevent PII from leaving the VPC.