PCSE Supporting Compliance Requirements — 40 Questions

Question 1

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

Accepted Answer

Bucket locking with a retention policy. Bucket locking with a retention policy is the correct answer because it enforces a WORM (Write Once, Read Many) model on Cloud Storage objects, preventing deletion or modification for a specified retention period. Once the retention policy is locked, even project owners cannot remove or shorten it, guaranteeing the 5-year immutability requirement. This is the only option that provides a policy-enforced, tamper-proof retention guarantee at the bucket level.

Answer

Lifecycle management rules

Answer

Object versioning

Answer

Object Retention Lock

Question 2

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

Accepted Answer

Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.. BigQuery audit logs are immutable and managed by Google Cloud Logging, so they cannot be edited or deleted in place with SQL. The correct GDPR-compliant approach is to route audit logs through a log sink that filters or redacts personal data before it lands in a destination such as Cloud Storage, preventing the data subject's information from being retained in the first place. This aligns with the principle of data minimization and avoids the immutability problem entirely.

Answer

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Answer

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Answer

Set a table expiration on the audit logs dataset to delete all logs after a short period.

Question 3

Which of the following is a customer responsibility under the Google Cloud shared responsibility model?

Accepted Answer

Encryption of data at rest and in transit. Under the Google Cloud shared responsibility model, Google secures the infrastructure (physical data centers, hardware, hypervisor, network), while the customer is responsible for securing their data and workloads — including encrypting data at rest and in transit, managing identities, and configuring access controls. Encryption of data at rest and in transit is explicitly a customer responsibility because the customer chooses the encryption method (Google-default, CMEK, CSEK, or client-side) and manages keys and TLS configurations.

Answer

Physical security of data centers

Answer

Hardware maintenance

Answer

Hypervisor security

Question 4

A company wants to enforce that all Cloud Storage buckets created in their organization have a retention policy for compliance. If a bucket is created without a retention policy, it should be automatically remediated. Which approach should they use?

Accepted Answer

Use an Organization Policy with a constraint to require a retention policy on all buckets and use Cloud Asset Inventory to enforce remediation.. Organization policies with a constraint can enforce that all buckets have a retention policy. However, if a bucket is created without one, Cloud Asset Inventory can detect the violation and trigger a Cloud Function to apply a default retention policy.

Answer

Use Cloud DLP to scan buckets and add retention policies automatically.

Answer

Use Security Command Center to find non-compliant buckets and manually apply retention policies.

Answer

Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.

Question 5

An organization must comply with ITAR regulations. They use Assured Workloads with the ITAR regime. Which THREE controls are automatically enforced by this regime? (Choose three.)

Accepted Answer

Use of Customer-Managed Encryption Keys (CMEK) for applicable services. Option B is correct because the Assured Workloads ITAR regime automatically enforces CMEK for supported services, ensuring encryption keys are managed by the customer within the compliance boundary. Option C is correct because ITAR requires that covered data remain within the United States, and the ITAR regime enforces US-only data residency by restricting resource locations to US regions. Option E is correct because the ITAR regime enables Access Transparency and Access Approval, which restrict and log Google personnel access to customer data, a key ITAR control. Option A is not correct because VPC Service Controls is not automatically configured by the ITAR regime; it is an optional additional control the customer may implement. Option D is not correct because Cloud Audit Logs retention is not set to 10 years by the ITAR regime; default log retention is 400 days and longer retention requires separate configuration.

Answer

VPC Service Controls automatically configured

Answer

Cloud Audit Logs retention set to 10 years

Question 6

A financial institution must store audit logs for 7 years to comply with PCI DSS requirements. By default, Cloud Audit Logs are retained for 30 days. What is the most cost-effective way to retain audit logs for 7 years?

Accepted Answer

Configure a log sink to export logs to Cloud Storage with a retention policy set to 7 years using Object Lifecycle Management.. The most cost-effective way to retain Cloud Audit Logs for 7 years is to configure a log sink that exports logs to a Cloud Storage bucket with a 7-year retention policy enforced via Object Lifecycle Management. Cloud Storage is significantly cheaper than retaining logs in Cloud Logging, and Object Lifecycle Management can automatically delete objects after 7 years, ensuring compliance without manual intervention. This approach decouples long-term retention from the default 30-day Cloud Logging retention.

Answer

Use Assured Workloads to automatically extend audit log retention to 7 years.

Answer

Create a log bucket with a retention period of 7 years using Log Analytics.

Answer

Increase the retention period for Cloud Audit Logs in the Logs Router to 7 years.

Question 7

A company subject to EU GDPR must implement the right to erasure (right to be forgotten) for personal data stored in BigQuery audit logs. The logs include query text that may contain personally identifiable information (PII). What is the correct approach to anonymize or delete PII from BigQuery audit logs?

Accepted Answer

Use Cloud DLP to scan and redact PII in the log entries as they are generated, and store redacted logs in BigQuery.. Cloud DLP can scan and redact PII in log entries as they are generated, ensuring that only de-identified data is stored in BigQuery. This satisfies GDPR's right to erasure by preventing PII from being persisted in the first place, while still retaining useful audit information. The redaction happens before storage, so deletion requests are inherently honored for future data.

Answer

Use Cloud Logging's exclusion filter to prevent PII from being logged in the first place.

Answer

Enable BigQuery table snapshot and restore to a point before the data was logged.

Answer

Delete the entire BigQuery dataset containing audit logs when a deletion request is received.

Question 8

A government contractor needs to deploy a workload on Google Cloud that complies with FedRAMP High and ITAR (International Traffic in Arms Regulations). They require that Google personnel cannot access the infrastructure and that data residency is restricted to the United States. Which Google Cloud solution should they use?

Accepted Answer

Assured Workloads with the FEDRAMP_HIGH and ITAR compliance regimes, and enable Google personnel access restrictions.. Assured Workloads is Google Cloud's purpose-built compliance framework that enforces regulatory controls at the folder level, including FedRAMP High and ITAR regimes. When you create an Assured Workloads folder with the ITAR regime, Google automatically applies data residency controls (US-only), personnel access restrictions (Google support personnel must be US persons with ITAR clearance), and other technical controls like CMEK and VPC Service Controls. This is the only option that directly addresses both the compliance certifications and the personnel access restriction requirement in a single managed solution.

Answer

VPC Service Controls with Organization Policies restricting resource location to the US.

Answer

Cloud HSM with Customer-Managed Encryption Keys (CMEK) stored in a US key region.

Answer

Deploy the workload in a Google Cloud region only available to US government customers (us-gov-west1).

Question 9

Which Google Cloud service provides the ability to enforce data retention policies on Cloud Storage objects to prevent deletion or modification for a specified duration?

Accepted Answer

Cloud Storage Object Retention Lock. Cloud Storage Object Retention Lock lets you set a retention period on individual objects during which they cannot be deleted or overwritten, enforcing data retention at the object level. This is the correct mechanism when the requirement is to prevent deletion or modification of specific objects for a specified duration. It is distinct from Bucket Lock, which applies a retention policy to an entire bucket.

Answer

Cloud Storage Bucket Lock

Answer

VPC Service Controls

Answer

Cloud Storage Object Lifecycle Management

Question 10

A company must process credit card transactions on Google Cloud and achieve PCI DSS compliance. They want to minimize the scope of the cardholder data environment (CDE). Which architectural approach should they take?

Accepted Answer

Create a separate VPC for the CDE, and route traffic through a dedicated project with VPC Service Controls and Private Google Access.. It isolates the CDE in its own VPC and project, which is the most effective way to minimize PCI DSS scope. VPC Service Controls add a security perimeter around Google Cloud services, preventing data exfiltration and unauthorized access, while Private Google Access allows internal-only communication with Google APIs without public IPs. This combination reduces the number of components that must be audited for PCI DSS, as the CDE is both network- and project-isolated.

Answer

Use separate VPCs for the CDE and non-CDE workloads, and connect them using VPC peering with firewall rules to restrict traffic.

Answer

Use a Shared VPC with a dedicated subnet for CDE resources and apply strict firewall rules.

Answer

Place all workloads in a single VPC and use Cloud Armor to protect the CDE.

Question 11

A multinational corporation uses Google Cloud and must comply with GDPR. They want to process personal data for a new purpose that was not originally disclosed to data subjects. What is the correct course of action under GDPR?

Accepted Answer

Obtain explicit consent from the data subjects for the new processing purpose.. Under GDPR Article 6(4) and Article 5(1)(b) (purpose limitation), personal data collected for one purpose cannot be processed for a materially different, undisclosed purpose without a valid legal basis. If consent was the original basis, or if no other Article 6 basis applies to the new purpose, the controller must obtain fresh, specific, informed, and unambiguous consent from data subjects for the new purpose. This is the only option that satisfies the purpose-limitation and lawfulness principles.

Answer

Anonymize the data before processing, as anonymized data is not subject to GDPR.

Answer

Rely on the existing DPA with Google, as it covers all processing activities.

Answer

Proceed with the new processing as long as the data is pseudonymized.

Question 12

A healthcare company stores de-identified patient data in BigQuery for analytics. They must comply with HIPAA and ensure that re-identification is not possible. They also need to be able to join data on a per-patient basis for longitudinal studies. Which TWO strategies should they implement? (Choose 2)

Accepted Answer

Use Cloud DLP to mask patient identifiers consistently across all tables.. Option A is correct because Cloud DLP's masking (via de-identify templates with a deterministic masking transformation, e.g., a Crypto-based or format-preserving masking) produces the same masked value for the same input across all tables, so records for the same patient remain joinable while the original identifier is not recoverable. Option E is correct because Cloud DLP tokenization with a consistent (deterministic) token, using a CryptoKey-based transformation such as deterministic encryption or FFX, replaces identifiers with a stable surrogate value that preserves per-patient joins for longitudinal studies while preventing re-identification. Option B is not appropriate because differential privacy adds noise to query results and is designed for aggregate/statistical release, not for exact per-patient joins. Option C does not satisfy the requirement because column-level security only restricts who can read identifiers; it does not de-identify the data or prevent re-identification. Option D is also insufficient because keeping raw identifiers in a separate dataset still leaves them present and joinable, so re-identification remains possible if that dataset is accessed or joined.

Answer

Apply differential privacy to all queries using the Differential Privacy library in BigQuery.

Answer

Enable BigQuery column-level security to restrict access to identifiers.

Answer

Store patient identifiers in a separate, access-controlled dataset and join using SQL.

Question 13

A data subject requests the deletion of their personal data from a Google Cloud project under GDPR. This data is stored in BigQuery audit logs that are retained for 30 days by default. What is the correct approach to fulfill this request?

Accepted Answer

Configure a log sink to exclude the data subject's audit logs and delete the existing logs by deleting the dataset that stores them.. Audit logs in Google Cloud are immutable and cannot be edited or deleted on a per-record basis; they are managed by Cloud Logging, not by BigQuery DML. To honor a GDPR erasure request, you must stop future ingestion of the data subject's logs by configuring a log sink exclusion filter, and then delete the existing logs by deleting the BigQuery dataset that stores the exported logs (or by letting the 30-day retention expire, but deletion is faster). This is the only supported method to remove specific log entries from an exported dataset.

Answer

Use the BigQuery DELETE statement to remove the specific rows containing the data subject's information.

Answer

Submit a request to Google Cloud Support to remove the personal data from the logs.

Answer

Use a Data Loss Prevention (DLP) job to redact the personal data from the audit logs.

Question 14

A company is implementing GDPR compliance and wants to ensure that personal data is pseudonymized in BigQuery. They plan to use Cloud DLP to tokenize data before loading. Which approach should they take to minimize changes to existing SQL queries?

Accepted Answer

Use Cloud DLP integration with BigQuery via SQL functions like `DLP_TOKENIZE`.. BigQuery has built-in functions like `DLP_TOKENIZE` that can be used in SQL queries to tokenize data on the fly without changing the schema. This allows pseudonymization while preserving the ability to query. Pre-processing with Dataflow would change the way data is stored and require modifications to queries. Using Cloud Functions adds complexity. Cloud KMS does not tokenize.

Answer

Use Cloud Dataflow to tokenize the data during ingestion into BigQuery.

Answer

Use Cloud KMS to encrypt the data at rest.

Answer

Use Cloud Functions to tokenize data after loading into BigQuery.

Question 15

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated and that only authorized services can communicate. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud Armor. VPC Service Controls create a secure perimeter around the CDE resources, preventing data exfiltration. Cloud Armor provides web application firewall capabilities to protect the application. Cloud NAT is for outbound connectivity, Cloud IDS is for intrusion detection, and Cloud VPN is for site-to-site VPN, not isolation.

Answer

Cloud IDS

Answer

Cloud NAT

Answer

Cloud VPN

Question 16

A financial institution needs to comply with GDPR data subject rights. They must ensure that personal data in BigQuery can be anonymized for analytics while still allowing joins on pseudonymized identifiers. Which THREE services or features should they consider? (Choose 3)

Accepted Answer

Cloud Dataflow. Cloud Dataflow (C) is correct because it provides scalable, serverless Apache Beam pipelines that can transform and pseudonymize or anonymize personal data in motion before it lands in BigQuery, supporting GDPR data-subject rights at scale. Cloud DLP (D) is correct because it is the dedicated service for discovering, classifying, and de-identifying sensitive data using techniques such as pseudonymization (crypto-based tokenization with format-preserving encryption) and k-anonymity, which preserve joinability on pseudonymized identifiers. BigQuery SQL functions such as DLP_TOKENIZE (E) are correct because they let analysts apply DLP-backed tokenization directly in SQL, producing deterministic pseudonyms that allow joins across tables while keeping the original personal data out of analytics. Cloud Functions (A) is not appropriate here because it is a lightweight event-driven compute service, not a data-processing engine designed for large-scale de-identification pipelines. Cloud KMS (B) is not the right fit because it manages encryption keys and cryptographic operations, but it does not itself discover, classify, or pseudonymize PII for analytics.

Answer

Cloud Functions

Answer

Cloud KMS

Question 17

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the Cardholder Data Environment (CDE) is isolated from other resources and that only authorized services can communicate with it. Which combination of controls should they implement?

Accepted Answer

Implement VPC Service Controls to define a perimeter around the CDE, and use VPC firewall rules to restrict traffic. VPC Service Controls create a service perimeter that prevents data exfiltration and restricts access to Google Cloud services within the CDE, while VPC firewall rules control ingress/egress traffic at the network layer. Together they provide both service-level and network-level isolation required by PCI DSS for the Cardholder Data Environment. This combination directly addresses the need to isolate the CDE and allow only authorized services to communicate with it.

Answer

Enable Cloud NAT for outbound internet access from the CDE

Answer

Use Shared VPC with a single network for all environments

Answer

Use Cloud Armor as the only security measure

Question 18

A company subject to GDPR receives a request from a data subject to delete all personal data from BigQuery audit logs. The logs contain query execution details with user identifiers. How can the company comply with the right to erasure (right to be forgotten)?

Accepted Answer

Use the Data Subject Request tool in Google Cloud to request erasure of the specific personal data from audit logs. BigQuery audit logs (Cloud Audit Logs) are immutable and cannot be deleted directly by customers. To comply with erasure requests, the company must use the Data Subject Request tool to request removal, as Google retains logs for 30 days and may need to remove them.

Answer

Create a log sink to export logs to Cloud Storage, then delete the sink and the exported objects

Answer

Delete the entire BigQuery dataset containing the logs

Answer

Use Cloud DLP to redact personally identifiable information from the logs

Question 19

A company is using BigQuery to store analytics data and wants to ensure that data is retained for exactly 365 days after ingestion, then automatically deleted. How can they achieve this with minimal operational overhead?

Accepted Answer

Set the table expiration to 365 days using the ALTER TABLE SET OPTIONS statement. BigQuery supports table-level expiration via the ALTER TABLE SET OPTIONS statement with expiration_timestamp, which automatically deletes the table (and its data) after the specified time. Setting it to 365 days after ingestion meets the retention requirement with no custom code or operational overhead. This is a native, declarative feature managed by BigQuery.

Answer

Use Cloud Storage Object Lifecycle rules on the data exported to Cloud Storage

Answer

Create a Cloud Function to delete tables older than 365 days

Answer

Configure a BigQuery scheduled query to delete rows older than 365 days

Question 20

A company needs to store audit logs for a minimum of 5 years to meet compliance requirements. Cloud Logging retains logs for 30 days by default. Which approach should they take?

Accepted Answer

Create a log sink to export logs to Cloud Storage, and use Object Lifecycle Management to delete objects after 5 years. Cloud Logging's default retention is 30 days, so meeting a 5-year compliance requirement requires exporting logs outside Cloud Logging. A log sink to Cloud Storage preserves the logs durably, and Object Lifecycle Management can be configured to delete objects after 5 years, satisfying both retention and eventual cleanup. This is the standard, cost-effective pattern for long-term audit log retention.

Answer

Store logs in BigQuery and set table expiration to 5 years

Answer

Use Cloud Functions to periodically copy logs to a persistent disk

Answer

Enable the 'Log Retention' setting in Cloud Logging to 5 years