PCSE Supporting Compliance Requirements — 40 Questions

Question 1

A company is deploying a workload that must comply with FedRAMP High. They are using Assured Workloads. Which TWO controls are automatically enabled when they select the FEDRAMP_HIGH regime?

Accepted Answer

Resource location restrictions (data must remain in the US). When selecting the FEDRAMP_HIGH regime in Assured Workloads, only resource location restrictions (data must remain in the US) and compliance monitoring are automatically enforced. Google personnel access restrictions is an optional control that must be manually enabled. VPC Service Controls and Cloud Armor WAF are not automatically enforced by Assured Workloads.

Answer

Google personnel access restrictions

Answer

VPC Service Controls

Answer

Cloud Armor WAF

Question 2

A company is implementing a data retention policy to comply with regulatory requirements. They need to retain certain BigQuery data for 7 years and ensure it cannot be deleted before the retention period ends. Which TWO steps should they take? (Choose two.)

Accepted Answer

Use IAM conditions to restrict who can delete the dataset or table.. To prevent deletion of BigQuery data for 7 years, the recommended steps are to use IAM conditions to restrict delete permissions and to export data to Cloud Storage with Bucket Lock. BigQuery does not have a native deletion prevention feature; dataset retention policies only schedule automatic deletion and do not prevent deletion. Cloud KMS key destruction makes data unreadable but does not prevent deletion. Object lifecycle management would delete data, which is the opposite of retention.

Answer

Set a retention policy on the BigQuery dataset to prevent accidental deletion.

Answer

Use Cloud KMS to encrypt the data and destroy the key after 7 years.

Answer

Enable object lifecycle management to delete data after 7 years.

Question 3

A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP can inspect Cloud Storage buckets for sensitive data like PHI and redact or de-identify it automatically using its inspect and transform pipeline.

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Security Command Center

Question 4

A company needs to retain audit logs for 7 years to meet compliance requirements. By default, Cloud Audit Logs are retained for 30 days. What should they do to retain the logs for 7 years?

Accepted Answer

Create a log sink to export audit logs to a Cloud Storage bucket with a retention policy set to 7 years.. Log Sinks can route logs to Cloud Storage Buckets, which support retention policies. Object Retention Lock can enforce WORM compliance if required.

Answer

Increase the default audit log retention period in the Logging settings to 7 years.

Answer

Enable Logging export to BigQuery and set table expiration to 7 years.

Answer

Use Cloud Functions to copy audit logs daily to Coldline Storage.

Question 5

A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?

Accepted Answer

Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.. VPC Service Controls provide a perimeter that prevents data exfiltration from managed services, while GKE network policies enforce pod-level isolation. Both are recommended for PCI DSS CDE isolation.

Answer

Use Cloud Armor to inspect all traffic and block non-compliant requests.

Answer

Enable Data Loss Prevention to scan payment data and restrict access.

Answer

Deploy the CDE in a separate project and use IAM roles to restrict access.

Question 6

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

Accepted Answer

Assured Workloads. Assured Workloads includes Access Transparency and Access Approval controls to restrict Google personnel access. When creating an Assured Workload with ITAR regime, these controls are enabled by default.

Answer

IAM Conditions

Answer

VPC Service Controls

Answer

Cloud HSM

Question 7

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

Accepted Answer

Bucket locking with a retention policy. Bucket locking with a retention policy allows you to set a WORM (Write Once, Read Many) policy on a bucket, preventing object deletion or modification for a specified duration. This is the correct feature for implementing a 5-year data retention policy that prevents any modification or deletion. Object Retention Lock is an AWS S3 feature, not a GCP feature, so option D is incorrect.

Answer

Lifecycle management rules

Answer

Object versioning

Answer

Object Retention Lock

Question 8

A company processes personal data of European Union residents on GCP. They need to ensure that data processing is limited to specific purposes and that data subjects can exercise their rights (access, rectification, erasure). Which actions should they take to comply with GDPR?

Accepted Answer

Sign a DPA with Google, implement data subject request workflows, and use Cloud DLP to classify personal data.. To comply with GDPR, the company must sign a Data Processing Agreement (DPA) with Google, implement data subject rights (like deletion), and document processing purposes. Encryption is encouraged but not a specific GDPR requirement listed in the options.

Answer

Use Assured Workloads with EU Regions and Support and enable Access Transparency.

Answer

Enable data encryption with CMEK and sign a DPA with Google.

Answer

Enable VPC Service Controls and restrict data access to EU regions.

Question 9

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud does not require prior approval for penetration testing of most services, but Denial of Service (DoS) testing is explicitly prohibited.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.

Question 10

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

Accepted Answer

Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.. BigQuery audit logs are immutable and cannot be deleted individually. The recommended approach is to export logs to Cloud Storage and use log sinks to filter out or redact personal data before storage.

Answer

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Answer

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Answer

Set a table expiration on the audit logs dataset to delete all logs after a short period.

Question 11

Which Google Cloud compliance certification requires the customer to sign a Business Associate Agreement (BAA) with Google?

Accepted Answer

HIPAA. HIPAA requires a BAA between a covered entity (or business associate) and Google Cloud before processing Protected Health Information (PHI).

Answer

PCI DSS

Answer

SOC 2

Answer

FedRAMP

Question 12

A government contractor needs to deploy workloads on GCP that meet FedRAMP High baseline requirements. They want to enforce resource location restrictions and access controls for Google personnel. Which product should they use?

Accepted Answer

Assured Workloads. Assured Workloads provides compliance-focused folders that enforce location restrictions, personnel access controls, and other controls specific to the chosen regime (e.g., FedRAMP High).

Answer

Cloud Security Command Center

Answer

VPC Service Controls

Answer

Organization Policies

Question 13

Which of the following is a customer responsibility under the Google Cloud shared responsibility model?

Accepted Answer

Encryption of data at rest and in transit. The shared responsibility model assigns physical security, hardware, and hypervisor security to Google; the customer is responsible for data encryption, IAM, network controls, and application security.

Answer

Physical security of data centers

Answer

Hardware maintenance

Answer

Hypervisor security

Question 14

A company wants to enforce that all Cloud Storage buckets created in their organization have a retention policy for compliance. If a bucket is created without a retention policy, it should be automatically remediated. Which approach should they use?

Accepted Answer

Use an Organization Policy with a constraint to require a retention policy on all buckets and use Cloud Asset Inventory to enforce remediation.. Organization policies with a constraint can enforce that all buckets have a retention policy. However, if a bucket is created without one, Cloud Asset Inventory can detect the violation and trigger a Cloud Function to apply a default retention policy.

Answer

Use Cloud DLP to scan buckets and add retention policies automatically.

Answer

Use Security Command Center to find non-compliant buckets and manually apply retention policies.

Answer

Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.

Question 15

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Accepted Answer

Use Cloud External Key Manager (EKM) with a supported partner.. PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Answer

Use SHA-1 for SSL certificates.

Answer

Use default Google encryption keys (Google-managed) for data at rest.

Answer

Use TLS 1.0 for data in transit.

Question 16

An organization must comply with ITAR regulations. They use Assured Workloads with the ITAR regime. Which THREE controls are automatically enforced by this regime? (Choose three.)

Accepted Answer

Use of Customer-Managed Encryption Keys (CMEK) for applicable services. Assured Workloads for ITAR enforces data residency, personnel access restrictions, and encryption with CMEK. VPC Service Controls, while important, are not automatically enforced by the regime itself but can be added separately.

Answer

VPC Service Controls automatically configured

Answer

Cloud Audit Logs retention set to 10 years

Question 17

A company processes healthcare data and has signed a BAA with Google Cloud. They need to implement controls for HIPAA compliance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Provide security awareness training to all workforce members.. HIPAA requires workforce training, access logging for covered services, and data classification to identify PHI. CMEK is optional; Cloud Armor is for web application security but not specifically required by HIPAA.

Answer

Enable Customer-Managed Encryption Keys (CMEK) for all services.

Answer

Use Cloud Armor to protect the web application from DDoS attacks.

Question 18

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) while maintaining HIPAA compliance. They have executed a Business Associate Agreement (BAA) with Google. Which additional step is required to ensure that PHI is properly classified and protected?

Accepted Answer

Use Cloud Data Loss Prevention (DLP) to inspect and classify storage buckets containing PHI.. For HIPAA compliance, after signing a BAA, organizations must implement data classification. Cloud DLP provides the ability to discover and classify PHI across GCP services.

Answer

Enable Audit Logs for all services that process PHI.

Answer

Configure Cloud Armor to protect web applications handling PHI.

Answer

Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.

Question 19

A financial institution must store audit logs for 7 years to comply with PCI DSS requirements. By default, Cloud Audit Logs are retained for 30 days. What is the most cost-effective way to retain audit logs for 7 years?

Accepted Answer

Configure a log sink to export logs to Cloud Storage with a retention policy set to 7 years using Object Lifecycle Management.. To retain audit logs beyond Cloud Logging's 365-day max, export to Cloud Storage using a log sink and use Object Lifecycle Management to set a retention policy.

Answer

Use Assured Workloads to automatically extend audit log retention to 7 years.

Answer

Create a log bucket with a retention period of 7 years using Log Analytics.

Answer

Increase the retention period for Cloud Audit Logs in the Logs Router to 7 years.

Question 20

A company subject to EU GDPR must implement the right to erasure (right to be forgotten) for personal data stored in BigQuery audit logs. The logs include query text that may contain personally identifiable information (PII). What is the correct approach to anonymize or delete PII from BigQuery audit logs?

Accepted Answer

Use Cloud DLP to scan and redact PII in the log entries as they are generated, and store redacted logs in BigQuery.. Cloud DLP can inspect and redact PII in BigQuery tables, enabling compliance with erasure requests while maintaining audit records.

Answer

Use Cloud Logging's exclusion filter to prevent PII from being logged in the first place.

Answer

Enable BigQuery table snapshot and restore to a point before the data was logged.

Answer

Delete the entire BigQuery dataset containing audit logs when a deletion request is received.