PCSE Supporting Compliance Requirements Practice Test 2 — 15 Questions

Question 1

An organization must comply with ITAR regulations. They use Assured Workloads with the ITAR regime. Which THREE controls are automatically enforced by this regime? (Choose three.)

Accepted Answer

Use of Customer-Managed Encryption Keys (CMEK) for applicable services. Assured Workloads for ITAR enforces data residency, personnel access restrictions, and encryption with CMEK. VPC Service Controls, while important, are not automatically enforced by the regime itself but can be added separately.

Answer

VPC Service Controls automatically configured

Answer

Cloud Audit Logs retention set to 10 years

Question 2

A company processes healthcare data and has signed a BAA with Google Cloud. They need to implement controls for HIPAA compliance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Provide security awareness training to all workforce members.. HIPAA requires workforce training, access logging for covered services, and data classification to identify PHI. CMEK is optional; Cloud Armor is for web application security but not specifically required by HIPAA.

Answer

Enable Customer-Managed Encryption Keys (CMEK) for all services.

Answer

Use Cloud Armor to protect the web application from DDoS attacks.

Question 3

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) while maintaining HIPAA compliance. They have executed a Business Associate Agreement (BAA) with Google. Which additional step is required to ensure that PHI is properly classified and protected?

Accepted Answer

Use Cloud Data Loss Prevention (DLP) to inspect and classify storage buckets containing PHI.. For HIPAA compliance, after signing a BAA, organizations must implement data classification. Cloud DLP provides the ability to discover and classify PHI across GCP services.

Answer

Enable Audit Logs for all services that process PHI.

Answer

Configure Cloud Armor to protect web applications handling PHI.

Answer

Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.

Question 4

A financial institution must store audit logs for 7 years to comply with PCI DSS requirements. By default, Cloud Audit Logs are retained for 30 days. What is the most cost-effective way to retain audit logs for 7 years?

Accepted Answer

Configure a log sink to export logs to Cloud Storage with a retention policy set to 7 years using Object Lifecycle Management.. To retain audit logs beyond Cloud Logging's 365-day max, export to Cloud Storage using a log sink and use Object Lifecycle Management to set a retention policy.

Answer

Use Assured Workloads to automatically extend audit log retention to 7 years.

Answer

Create a log bucket with a retention period of 7 years using Log Analytics.

Answer

Increase the retention period for Cloud Audit Logs in the Logs Router to 7 years.

Question 5

A company subject to EU GDPR must implement the right to erasure (right to be forgotten) for personal data stored in BigQuery audit logs. The logs include query text that may contain personally identifiable information (PII). What is the correct approach to anonymize or delete PII from BigQuery audit logs?

Accepted Answer

Use Cloud DLP to scan and redact PII in the log entries as they are generated, and store redacted logs in BigQuery.. Cloud DLP can inspect and redact PII in BigQuery tables, enabling compliance with erasure requests while maintaining audit records.

Answer

Use Cloud Logging's exclusion filter to prevent PII from being logged in the first place.

Answer

Enable BigQuery table snapshot and restore to a point before the data was logged.

Answer

Delete the entire BigQuery dataset containing audit logs when a deletion request is received.

Question 6

A government contractor needs to deploy a workload on Google Cloud that complies with FedRAMP High and ITAR (International Traffic in Arms Regulations). They require that Google personnel cannot access the infrastructure and that data residency is restricted to the United States. Which Google Cloud solution should they use?

Accepted Answer

Assured Workloads with the FEDRAMP_HIGH and ITAR compliance regimes, and enable Google personnel access restrictions.. Assured Workloads provides a consolidated compliance framework that includes FedRAMP, ITAR, and access restrictions.

Answer

VPC Service Controls with Organization Policies restricting resource location to the US.

Answer

Cloud HSM with Customer-Managed Encryption Keys (CMEK) stored in a US key region.

Answer

Deploy the workload in a Google Cloud region only available to US government customers (us-gov-west1).

Question 7

Which Google Cloud service provides the ability to enforce data retention policies on Cloud Storage objects to prevent deletion or modification for a specified duration?

Accepted Answer

Cloud Storage Object Retention Lock. Object Retention Lock uses retention policies and legal holds to comply with WORM requirements.

Answer

Cloud Storage Bucket Lock

Answer

VPC Service Controls

Answer

Cloud Storage Object Lifecycle Management

Question 8

A company must process credit card transactions on Google Cloud and achieve PCI DSS compliance. They want to minimize the scope of the cardholder data environment (CDE). Which architectural approach should they take?

Accepted Answer

Create a separate VPC for the CDE, and route traffic through a dedicated project with VPC Service Controls and Private Google Access.. Network segmentation is key to minimizing PCI DSS scope. A separate VPC for the CDE, combined with VPC Service Controls, isolates cardholder data.

Answer

Use separate VPCs for the CDE and non-CDE workloads, and connect them using VPC peering with firewall rules to restrict traffic.

Answer

Use a Shared VPC with a dedicated subnet for CDE resources and apply strict firewall rules.

Answer

Place all workloads in a single VPC and use Cloud Armor to protect the CDE.

Question 9

A company needs to ensure that all data stored in Cloud Storage is encrypted at rest using keys that they generate and manage themselves. They also need to rotate the keys every 90 days. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. CMEK gives customers control over key lifecycle, including automatic rotation every 90 days.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Google-managed encryption keys (GMEK)

Question 10

A security engineer needs to audit changes to IAM policies across their Google Cloud organization. Which audit log type should they enable to capture IAM policy changes?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture all API calls that modify configuration, including IAM policy changes.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

Access Transparency logs

Question 11

Which Google Cloud service is specifically designed to help customers meet compliance requirements by creating a folder with pre-defined organization policies, resource location restrictions, and access controls?

Accepted Answer

Assured Workloads. Assured Workloads automates the creation of a compliant environment with pre-configured controls.

Answer

VPC Service Controls

Answer

Cloud HSM

Answer

Security Command Center

Question 12

A multinational corporation uses Google Cloud and must comply with GDPR. They want to process personal data for a new purpose that was not originally disclosed to data subjects. What is the correct course of action under GDPR?

Accepted Answer

Obtain explicit consent from the data subjects for the new processing purpose.. GDPR requires a valid legal basis for each processing purpose. For a new purpose, explicit consent is often required unless another basis applies.

Answer

Anonymize the data before processing, as anonymized data is not subject to GDPR.

Answer

Rely on the existing DPA with Google, as it covers all processing activities.

Answer

Proceed with the new processing as long as the data is pseudonymized.

Question 13

A security team wants to monitor for compliance drift in an Assured Workloads folder that enforces FedRAMP High controls. Which Google Cloud service should they use to detect violations of organization policies?

Accepted Answer

Security Command Center. Security Command Center includes a compliance dashboard and can detect policy violations in Assured Workloads.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

Cloud Audit Logs

Question 14

A company is required to perform penetration testing on their Google Cloud infrastructure. According to Google Cloud's policy, which statement is true regarding penetration testing?

Accepted Answer

No prior approval is needed for testing most services, but denial-of-service (DoS) attacks are not permitted.. Google Cloud's Acceptable Use Policy permits penetration testing on most services without prior approval, but DoS attacks are forbidden.

Answer

Customers must use Google's own penetration testing tools, such as Web Security Scanner.

Answer

Prior approval from Google is required for all penetration testing activities.

Answer

Penetration testing is prohibited on Google Cloud unless it is conducted by a certified third party.

Question 15

A healthcare company stores de-identified patient data in BigQuery for analytics. They must comply with HIPAA and ensure that re-identification is not possible. They also need to be able to join data on a per-patient basis for longitudinal studies. Which TWO strategies should they implement? (Choose 2)

Accepted Answer

Use Cloud DLP to mask patient identifiers consistently across all tables.. Tokenization or consistent masking allows longitudinal joins while de-identifying data. Other methods either risk re-identification or break join capability.

Answer

Apply differential privacy to all queries using the Differential Privacy library in BigQuery.

Answer

Enable BigQuery column-level security to restrict access to identifiers.

Answer

Store patient identifiers in a separate, access-controlled dataset and join using SQL.