PCSE Supporting Compliance Requirements — 10 Questions

Question 1

A company is deploying a workload that must comply with FedRAMP High. They are using Assured Workloads. Which TWO controls are automatically enabled when they select the FEDRAMP_HIGH regime?

Accepted Answer

Resource location restrictions (data must remain in the US). When selecting the FEDRAMP_HIGH regime in Assured Workloads, only resource location restrictions (data must remain in the US) and compliance monitoring are automatically enforced. Google personnel access restrictions is an optional control that must be manually enabled. VPC Service Controls and Cloud Armor WAF are not automatically enforced by Assured Workloads.

Answer

Google personnel access restrictions

Answer

VPC Service Controls

Answer

Cloud Armor WAF

Question 2

A company is implementing a data retention policy to comply with regulatory requirements. They need to retain certain BigQuery data for 7 years and ensure it cannot be deleted before the retention period ends. Which TWO steps should they take? (Choose two.)

Accepted Answer

Use IAM conditions to restrict who can delete the dataset or table.. To prevent deletion of BigQuery data for 7 years, the recommended steps are to use IAM conditions to restrict delete permissions and to export data to Cloud Storage with Bucket Lock. BigQuery does not have a native deletion prevention feature; dataset retention policies only schedule automatic deletion and do not prevent deletion. Cloud KMS key destruction makes data unreadable but does not prevent deletion. Object lifecycle management would delete data, which is the opposite of retention.

Answer

Set a retention policy on the BigQuery dataset to prevent accidental deletion.

Answer

Use Cloud KMS to encrypt the data and destroy the key after 7 years.

Answer

Enable object lifecycle management to delete data after 7 years.

Question 3

A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP can inspect Cloud Storage buckets for sensitive data like PHI and redact or de-identify it automatically using its inspect and transform pipeline.

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Security Command Center

Question 4

A company needs to retain audit logs for 7 years to meet compliance requirements. By default, Cloud Audit Logs are retained for 30 days. What should they do to retain the logs for 7 years?

Accepted Answer

Create a log sink to export audit logs to a Cloud Storage bucket with a retention policy set to 7 years.. Log Sinks can route logs to Cloud Storage Buckets, which support retention policies. Object Retention Lock can enforce WORM compliance if required.

Answer

Increase the default audit log retention period in the Logging settings to 7 years.

Answer

Enable Logging export to BigQuery and set table expiration to 7 years.

Answer

Use Cloud Functions to copy audit logs daily to Coldline Storage.

Question 5

A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?

Accepted Answer

Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.. VPC Service Controls provide a perimeter that prevents data exfiltration from managed services, while GKE network policies enforce pod-level isolation. Both are recommended for PCI DSS CDE isolation.

Answer

Use Cloud Armor to inspect all traffic and block non-compliant requests.

Answer

Enable Data Loss Prevention to scan payment data and restrict access.

Answer

Deploy the CDE in a separate project and use IAM roles to restrict access.

Question 6

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

Accepted Answer

Assured Workloads. Assured Workloads includes Access Transparency and Access Approval controls to restrict Google personnel access. When creating an Assured Workload with ITAR regime, these controls are enabled by default.

Answer

IAM Conditions

Answer

VPC Service Controls

Answer

Cloud HSM

Question 7

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

Accepted Answer

Bucket locking with a retention policy. Bucket locking with a retention policy allows you to set a WORM (Write Once, Read Many) policy on a bucket, preventing object deletion or modification for a specified duration. This is the correct feature for implementing a 5-year data retention policy that prevents any modification or deletion. Object Retention Lock is an AWS S3 feature, not a GCP feature, so option D is incorrect.

Answer

Lifecycle management rules

Answer

Object versioning

Answer

Object Retention Lock

Question 8

A company processes personal data of European Union residents on GCP. They need to ensure that data processing is limited to specific purposes and that data subjects can exercise their rights (access, rectification, erasure). Which actions should they take to comply with GDPR?

Accepted Answer

Sign a DPA with Google, implement data subject request workflows, and use Cloud DLP to classify personal data.. To comply with GDPR, the company must sign a Data Processing Agreement (DPA) with Google, implement data subject rights (like deletion), and document processing purposes. Encryption is encouraged but not a specific GDPR requirement listed in the options.

Answer

Use Assured Workloads with EU Regions and Support and enable Access Transparency.

Answer

Enable data encryption with CMEK and sign a DPA with Google.

Answer

Enable VPC Service Controls and restrict data access to EU regions.

Question 9

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud does not require prior approval for penetration testing of most services, but Denial of Service (DoS) testing is explicitly prohibited.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.

Question 10

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

Accepted Answer

Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.. BigQuery audit logs are immutable and cannot be deleted individually. The recommended approach is to export logs to Cloud Storage and use log sinks to filter out or redact personal data before storage.

Answer

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Answer

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Answer

Set a table expiration on the audit logs dataset to delete all logs after a short period.