PCSE Ensuring data protection Practice Test 6 — 15 Questions

Question 1

A company must comply with PCI DSS requirements that mandate the use of a hardware security module (HSM) for key storage. They plan to use Cloud KMS for key management. Which implementation meets compliance?

Accepted Answer

Create a Cloud HSM key ring and use Cloud KMS with protection level 'HSM'.. Option B is correct because PCI DSS requires that cryptographic keys be stored in a hardware security module (HSM) to ensure tamper resistance. Cloud HSM provides a FIPS 140-2 Level 3 validated HSM directly integrated with Cloud KMS, allowing you to create keys with the 'HSM' protection level that are generated and stored within the HSM hardware, meeting compliance without managing external infrastructure.

Answer

Use Cloud External Key Manager (EKM) with an external HSM.

Answer

Use Customer-Supplied Encryption Keys (CSEK) stored in an on-premises HSM.

Answer

Create keys in Cloud KMS using the default software protection level.

Question 2

Which TWO options are required to use Cloud DLP to successfully inspect data in a Cloud Storage bucket?

Accepted Answer

A service account with roles/storage.objectViewer to read the bucket.. Option A is correct because Cloud DLP requires read access to the Cloud Storage bucket to inspect objects. The service account used by the DLP job must have the roles/storage.objectViewer IAM role, which grants permission to list and read objects without needing to download them. This ensures the DLP API can access the data for content inspection.

Answer

A Cloud Function to send each file to the DLP API.

Answer

The bucket must be in the same project as the DLP job.

Answer

A Pub/Sub topic to receive inspection results.

Question 3

Which THREE are best practices for managing encryption keys in Google Cloud?

Accepted Answer

Enable automatic rotation for keys that are used for encryption.. Option A is correct because Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Answer

Import key material from on-premises HSMs to avoid vendor lock-in.

Answer

Automatically delete old key versions once they expire.

Question 4

Which THREE Google Cloud services can encrypt data at rest?

Accepted Answer

Cloud Storage. Cloud Storage encrypts data at rest by default using server-side encryption (SSE) with either Google-managed keys or customer-managed keys via Cloud KMS. This ensures that all objects stored in buckets are encrypted before being written to disk, protecting data from unauthorized access at the storage layer.

Answer

Cloud CDN

Answer

Cloud Functions

Question 5

Refer to the exhibit. The security team created this key for encrypting database backups. After an audit, they found that data encrypted before May 1, 2023, cannot be decrypted. What is the most likely cause?

Accepted Answer

Key version 1 was deleted after the new primary was created.. Option B is correct because when a new primary key version is created in Cloud KMS, the old primary key version is not automatically deleted. However, if the old key version (version 1) was manually deleted after promoting version 2 as the primary, any data encrypted with version 1 becomes permanently undecryptable. The audit finding that data encrypted before May 1, 2023 cannot be decrypted directly indicates that the key version used for that encryption (likely version 1) is no longer available, not just disabled or rotated.

Answer

The rotation period is too short, causing old versions to be destroyed.

Answer

The primary key version is disabled.

Answer

The algorithm GOOGLE_SYMMETRIC_ENCRYPTION is not supported by HSM.

Question 6

A global e-commerce company uses Google Cloud to host its platform. They store customer payment data in Cloud SQL and use Cloud Storage for backups. Currently, they rely on Google-managed encryption keys. A new compliance requirement mandates that all encryption keys must be stored in a hardware security module (HSM) and rotated every 30 days. Additionally, they need to retain backup data for 7 years, during which the keys used to encrypt the backups must be available for decryption. They have created a Cloud HSM key ring and a key with a rotation period of 2592000 seconds (30 days). After configuring Cloud SQL and Cloud Storage to use the Cloud HSM key, they notice that backups older than 30 days cannot be decrypted. The company's security engineer verified that the key versions are still present. What is the most likely cause and how should it be resolved?

Accepted Answer

The automatic backups in Cloud SQL are encrypted with the primary key version at backup time, but the backup restore functionality does not automatically use the latest key version. Update the backup configuration to use the current primary key version for decryption.. Option B is correct because Cloud SQL backups are encrypted with the primary key version at the time of backup creation. When restoring a backup, Cloud SQL does not automatically use the latest key version; it attempts to decrypt using the key version that was primary at backup time. Since the key is rotated every 30 days, backups older than 30 days were encrypted with a previous primary key version. Even though the key versions are still present in Cloud HSM, the backup restore operation fails because it does not automatically reference the correct historical key version. The fix is to explicitly update the backup configuration to point to the current primary key version, which allows Cloud SQL to locate and use the appropriate key version for decryption.

Answer

The key material was imported incorrectly. Delete the key ring and recreate it using an external HSM.

Answer

The rotation period of 30 days is too short for key retention. Disable automatic rotation and use manual key rotation every 30 days while retaining all versions.

Answer

Cloud Storage does not support Cloud HSM keys for object encryption. Switch to customer-supplied encryption keys (CSEK).

Question 7

A healthcare startup is building a data pipeline on Google Cloud. They receive patient data via a REST API running on Cloud Run. The data includes sensitive health information that must be de-identified before being stored in BigQuery. They plan to use Cloud DLP to inspect and transform the data. However, due to latency requirements, they need to de-identify the data within 5 seconds of receiving the request. They have set up a Cloud DLP job to inspect the data synchronously using the DLP API. During testing, they notice that the de-identification sometimes takes over 10 seconds, causing API timeouts. They want to reduce the latency without compromising security. What should they do?

Accepted Answer

Use Cloud DLP with a content item size limit and stored infoTypes to reduce inspection time.. Option B is correct because Cloud DLP synchronous inspection latency is directly proportional to the content size and the number of infoTypes scanned. By limiting the content item size (e.g., to 1 MB) and using stored infoTypes (which are pre-compiled for faster matching), you reduce the inspection time significantly, enabling de-identification within the 5-second window without compromising security.

Answer

Use a Cloud Function to process the data and call the DLP API.

Answer

Instead of using Cloud DLP, use BigQuery column-level security with data masking.

Answer

Configure a Cloud DLP job to run asynchronously and store results in BigQuery, then modified the pipeline to read the de-identified data later.

Question 8

A financial services company uses Cloud Storage to store sensitive customer data. They want to encrypt this data at rest using customer-managed encryption keys (CMEK) and automate key rotation every 90 days. Which approach should they take?

Accepted Answer

Create a Cloud KMS key ring and a key with rotation period 90 days. Use the key as CMEK for the Cloud Storage bucket.. Option B is correct because Cloud KMS allows you to create a key ring and a key with a defined rotation period of 90 days, which can then be used as a customer-managed encryption key (CMEK) for a Cloud Storage bucket. This satisfies the requirement for customer-controlled key management and automated rotation without custom code.

Answer

Rely on Google-managed encryption keys (default Cloud Storage encryption) and enable key rotation logs for auditing.

Answer

Configure Cloud External Key Manager (EKM) to manage the encryption key externally and have Cloud Storage use it via CMEK integration.

Answer

Use customer-supplied encryption keys (CSEK) and implement a custom Cloud Function to rotate keys every 90 days.

Question 9

A healthcare organization needs to redact Social Security Numbers (SSNs) from patient records stored in Cloud Storage before sharing them with a research partner. They plan to use Cloud DLP. Which TWO actions should they take to configure the DLP job correctly? (Choose two.)

Accepted Answer

Apply a de-identification template that uses the 'redact' transformation on the identified SSNs.. Option A is correct because Cloud DLP de-identification templates allow you to specify a 'redact' transformation that completely removes or replaces the matched sensitive data, such as SSNs, from the content. This ensures that the output files shared with the research partner contain no trace of the original SSNs, meeting the redaction requirement.

Answer

Configure Access Transparency logs to track who accesses the objects.

Answer

Encrypt the objects with a CMEK key before running the DLP inspection.

Answer

Enable VPC Service Controls to prevent unauthorized access to the bucket.

Question 10

A large enterprise runs analytics workloads on BigQuery containing sensitive financial data. They have implemented VPC Service Controls (VPC SC) to create a perimeter around the BigQuery dataset, allowing access only from a specific VPC network. Despite this, security auditors discovered that data was accessed from an IP address outside the perimeter. After investigation, they found the access originated from a user's personal laptop using the Google Cloud Console. The company's security policy requires that sensitive data can only be accessed from corporate-managed devices. What should they do to prevent this type of access?

Accepted Answer

Add a context-aware access level to the VPC Service perimeter that requires a corporate device policy (e.g., OS version, disk encryption).. Option D is correct because VPC Service Controls can integrate with Access Context Manager to enforce context-aware access levels. By adding a level that requires a corporate device policy (e.g., verified OS version, disk encryption status), access from unmanaged personal laptops is blocked at the perimeter boundary, even if the user is authenticated. This directly addresses the security policy requirement that sensitive data must only be accessible from corporate-managed devices.

Answer

Enable Cloud Data Loss Prevention (DLP) to automatically redact sensitive data before it is displayed in the console.

Answer

Reconfigure the VPC Service perimeter to use a more restrictive set of allowed IP ranges.

Answer

Activate Access Transparency logs and create a log-based alert to notify security of anomalous access.

Question 11

A company runs a containerized application on Google Kubernetes Engine (GKE) that reads from a Cloud Storage bucket encrypted with a customer-managed key (CMEK) in Cloud KMS. The application uses a dedicated Google service account with the roles/storage.objectViewer role and a Cloud KMS CryptoKey Decrypter binding on the key. After a scheduled key rotation, the application started receiving '403 Access Denied' errors when accessing objects. The Cloud KMS key has multiple versions. The service account's IAM permissions have not changed. What is the most likely cause and the appropriate fix?

Accepted Answer

Ensure the service account has the 'Cloud KMS CryptoKey Decrypter' role on the key, which applies to all key versions, including the old version used for encryption.. The correct answer is D. In Cloud KMS, IAM permissions are evaluated at the key level, not per key version. When a key is rotated, the new primary version is automatically enabled, but the old version remains active for decrypting data encrypted with it. The service account already has the 'Cloud KMS CryptoKey Decrypter' role on the key, which grants permission to decrypt with any version of that key. The 403 error likely occurred because the application's client library or configuration was explicitly referencing the old key version ID, which may have been disabled or is no longer primary, but the IAM binding on the key itself is sufficient. The fix is to ensure the service account has the role on the key (which it does) and that the application uses the key resource name (not a specific version) to allow automatic use of the correct version.

Answer

In Cloud KMS, enable the new key version and ensure it is set as primary.

Answer

Create a new key ring and migrate the service account to use a new key.

Answer

Disable the old key version and re-encrypt all objects with the new key version.

Question 12

A large enterprise is using Cloud Data Loss Prevention (DLP) to inspect a Cloud Storage bucket containing millions of files for sensitive data like credit card numbers and health information. The DLP inspection job is configured to scan the entire bucket with a schedule. Recently, the job has been failing with a 'Quota exceeded' error for the DLP inspect requests quota. The team needs to continue inspecting all files without increasing the quota limit, as the quota increase request would take weeks. They cannot skip any files due to compliance requirements. What should they do to work around the quota limit while inspecting all files?

Accepted Answer

Reconfigure the DLP job to use a smaller sampling size (e.g., 'bytesLimitPerFile' or 'filesLimitPercent') to stay within quota limits, and schedule more frequent runs to cover all files over time.. Option D is correct because by reducing the per-job scan volume (e.g., via 'bytesLimitPerFile' or 'filesLimitPercent'), the job stays within the DLP inspect requests quota while still covering all files over multiple scheduled runs. This approach respects the quota ceiling without skipping any files, as the sampling is applied per job execution, not per file permanently. The team can increase the job frequency to ensure the entire bucket is eventually inspected, meeting compliance requirements.

Answer

Switch from file store inspection to content inspection (items) and send each file individually via the API to bypass the file-level quota.

Answer

Create de-identification templates to automatically redact the found sensitive data, which reduces the need for inspection.

Answer

Submit a quota increase request and pause the inspection job until the increase is approved.

Question 13

A development team uses Cloud Secret Manager to store database credentials for an application running on Compute Engine. The application reads the secret using the Secret Manager API. After the team rotates the secret by adding a new version and setting it as the latest, the application continues to use the old secret version and fails to authenticate. The application is configured to fetch the secret with version 'latest' at startup. The team checks that the Compute Engine service account has the roles/secretmanager.secretAccessor role on the secret. What is the most likely cause of the issue?

Accepted Answer

Enable the new secret version by setting its state to 'enabled' via the Cloud Console, gcloud, or API.. When a new secret version is added via Cloud Secret Manager, it is created in the 'disabled' state by default. Even if it is set as the 'latest' version, the application cannot access it until the version is explicitly enabled. The application fetches the secret using the 'latest' label, which points to the disabled version, causing authentication failure. Enabling the new version resolves the issue.

Answer

Grant the service account the roles/secretmanager.secretAccessor at the project level instead of on the secret resource.

Answer

Update the application to use the specific version ID of the new secret instead of the 'latest' label.

Answer

Add an IAM condition on the secret that restricts access to only the latest version.

Question 14

A company runs a Cloud SQL for PostgreSQL instance that stores customer data. They must encrypt the database at rest using customer-managed encryption keys (CMEK) to meet regulatory requirements. The instance is currently using Google-managed encryption. What must they do to implement CMEK? The company wants to minimize downtime and avoid data loss.

Accepted Answer

Create a new Cloud SQL instance with CMEK enabled, then export data from the old instance and import into the new one.. Option B is correct because Cloud SQL does not support enabling CMEK on an existing instance; you must create a new instance with CMEK enabled at provisioning time. Exporting data from the old instance and importing it into the new one ensures the database is re-encrypted under the customer-managed key with minimal downtime and no data loss, as the export/import process preserves the data.

Answer

Use the gcloud command to update the existing instance to use CMEK by specifying the key.

Answer

Configure Cloud External Key Manager (EKM) and attach it to the existing instance via a patch operation.

Answer

Implement client-side encryption in the application using a library like Tink and store the encrypted data in the existing database.

Question 15

Alice has the role roles/storage.objectAdmin on the bucket my-bucket via the IAM policy shown. She is unable to access the object gs://my-bucket/reports/data.csv. What is the most likely reason?

Accepted Answer

The condition restricts access to objects with a prefix 'uploads/', and the requested object is under 'reports/'.. The IAM policy condition uses the `resource.name.startsWith('my-bucket/uploads/')` condition key, which restricts the `storage.objects.get` permission to objects whose name starts with `uploads/`. The requested object `gs://my-bucket/reports/data.csv` is under the `reports/` prefix, so the condition evaluates to false, denying access. This is the most likely reason Alice cannot access the object.

Answer

The bucket has a retention policy that prevents access to objects older than a certain period.

Answer

The condition uses the wrong resource attribute; it should be resource.name.startsWith('my-bucket/uploads/').

Answer

Alice does not have the storage.objects.get permission on the bucket.