PCSE Supporting Compliance Requirements Practice Test 3 — 15 Questions

Question 1

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) in Cloud Storage. They have signed a Business Associate Agreement (BAA) with Google. Which additional step is REQUIRED to ensure HIPAA compliance for the data stored?

Accepted Answer

No additional action is required; Cloud Storage is HIPAA-eligible and encrypts data at rest by default.. HIPAA requires encryption of PHI at rest. Cloud Storage automatically encrypts data at rest using Google-managed keys. Customers can optionally use CMEK, but CMEK is not required. Enabling Object Versioning is not a HIPAA requirement. Configuring a VPC is a network control, not a specific HIPAA requirement for storage.

Answer

Use Customer-Managed Encryption Keys (CMEK) for the bucket.

Answer

Configure the bucket to be in a VPC with no public access.

Answer

Enable Object Versioning on the bucket.

Question 2

A financial institution is deploying a PCI DSS-compliant web application on Google Cloud. They need to isolate the cardholder data environment (CDE) from other environments and protect the web application against common web attacks. Which combination of services meets these requirements?

Accepted Answer

VPC Service Controls and Cloud Armor. VPC Service Controls create a perimeter around Google Cloud resources to prevent data exfiltration. Cloud Armor is a web application firewall that protects against OWASP Top 10 attacks. Together they isolate the CDE and protect the application. Cloud IDS is for network threat detection, not isolation. Cloud NAT provides outbound internet access, not security. Cloud Load Balancing distributes traffic but does not isolate.

Answer

Cloud NAT and Cloud IDS

Answer

Identity-Aware Proxy (IAP) and Cloud Storage

Answer

Shared VPC and Cloud Load Balancing

Question 3

A company is using Assured Workloads to enforce FEDRAMP_HIGH compliance. They need to ensure that only US-based personnel from Google can access their data. Which configuration setting within the Assured Workloads folder should they enable?

Accepted Answer

Google personnel access restrictions. Assured Workloads provides access restrictions that can limit Google personnel access based on geographic location. The 'Google personnel access restrictions' setting can be configured to restrict access to Google personnel located in specific countries, e.g., the United States. The compliance regime selection defines the overall framework, while resource location restrictions control where data is stored.

Answer

Access Transparency logs

Answer

Resource location restrictions

Answer

Key Access Justification (KAJ) logs

Question 4

A data subject requests the deletion of their personal data from a Google Cloud project under GDPR. This data is stored in BigQuery audit logs that are retained for 30 days by default. What is the correct approach to fulfill this request?

Accepted Answer

Configure a log sink to exclude the data subject's audit logs and delete the existing logs by deleting the dataset that stores them.. BigQuery audit logs are immutable and cannot be modified or deleted individually. The right to be forgotten under GDPR requires deletion of personal data. The only way to comply is to delete the entire log entries or the dataset. Since the logs are retained for 30 days, you must either delete the specific logs by using a log sink to filter and exclude, or you can delete the entire dataset. However, the simplest approach is to delete the logs after they are no longer needed, but you cannot delete specific rows from BigQuery audit logs. The correct approach is to delete the dataset containing the logs if the logs are no longer needed for compliance; otherwise, you must exclude the data subject's information from future logs and delete existing ones via log routing.

Answer

Use the BigQuery DELETE statement to remove the specific rows containing the data subject's information.

Answer

Submit a request to Google Cloud Support to remove the personal data from the logs.

Answer

Use a Data Loss Prevention (DLP) job to redact the personal data from the audit logs.

Question 5

Which Google Cloud service can automatically classify and de-identify sensitive data such as credit card numbers and health records before it is stored in Cloud Storage?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP). Cloud Data Loss Prevention (DLP) is a service that inspects content for sensitive data types (e.g., credit card numbers, PHI) and can de-identify (mask, tokenize, etc.) that data. Cloud KMS manages encryption keys, Cloud Audit Logs records activities, and Cloud Asset Inventory tracks resources.

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Asset Inventory

Question 6

A company needs to store financial records for 7 years to meet regulatory requirements. They want to ensure that once written, the records cannot be modified or deleted by anyone, including cloud administrators. Which Cloud Storage feature should they enable?

Accepted Answer

Object Retention Lock with a locked retention policy. Object Retention Lock with a retention policy enforces a WORM (Write Once, Read Many) policy. Once a retention policy is locked, objects cannot be deleted or overwritten until the retention period expires, even by project owners. Bucket Lock (which is part of Object Retention Lock) makes the retention policy immutable. Object Versioning allows multiple versions but does not prevent deletion. CMEK provides encryption control, not immutability. Lifecycle management automates deletion, which is opposite of what is needed.

Answer

Lifecycle management rules

Answer

Object Versioning

Answer

Customer-Managed Encryption Keys (CMEK)

Question 7

A security engineer needs to run a penetration test against their Google Cloud environment. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval for most services, but DoS attacks are prohibited.. Google's policy allows customers to conduct penetration tests against their own infrastructure without prior approval for most services, provided the tests do not involve denial of service (DoS) attacks. DoS testing is explicitly prohibited without prior written approval. Testing other customers' resources is never allowed.

Answer

Penetration testing is not allowed against any Google Cloud resources.

Answer

Denial of Service (DoS) testing is allowed with prior notification to Google.

Answer

All penetration tests require prior approval from Google Cloud Support.

Question 8

A company is implementing GDPR compliance and wants to ensure that personal data is pseudonymized in BigQuery. They plan to use Cloud DLP to tokenize data before loading. Which approach should they take to minimize changes to existing SQL queries?

Accepted Answer

Use Cloud DLP integration with BigQuery via SQL functions like `DLP_TOKENIZE`.. BigQuery has built-in functions like `DLP_TOKENIZE` that can be used in SQL queries to tokenize data on the fly without changing the schema. This allows pseudonymization while preserving the ability to query. Pre-processing with Dataflow would change the way data is stored and require modifications to queries. Using Cloud Functions adds complexity. Cloud KMS does not tokenize.

Answer

Use Cloud Dataflow to tokenize the data during ingestion into BigQuery.

Answer

Use Cloud KMS to encrypt the data at rest.

Answer

Use Cloud Functions to tokenize data after loading into BigQuery.

Question 9

A healthcare organization needs to ensure that all access to ePHI in Cloud SQL is logged for HIPAA compliance. They have enabled audit logs. What additional step is required to ensure logs are retained for at least one year?

Accepted Answer

Create a log sink to export the logs to Cloud Storage.. Cloud Audit Logs are retained by default for 30 days (or 400 days for some logs with the default retention in the _Required bucket). To retain logs for longer, you must create a log sink that exports logs to Cloud Storage (or BigQuery). Enabling Access Transparency logs is good but not necessary for retention. Adjusting the retention period in the Logs Explorer is not possible; Logs Explorer only queries logs within the retention period.

Answer

Enable Access Transparency logs.

Answer

Set a retention policy on the Cloud SQL instance.

Answer

Adjust the retention period in the Logs Explorer to 1 year.

Question 10

An organization is using Assured Workloads to enforce ITAR compliance. They need to ensure that all resources are deployed in specific US regions and that Google personnel access is restricted. They also want to monitor for any configuration changes that violate compliance policies. Which service should they use for monitoring compliance drift?

Accepted Answer

Assured Workloads compliance monitoring. Assured Workloads provides a compliance monitoring feature that alerts on policy violations, including resource location and access restrictions. Cloud Monitoring is for performance metrics, Cloud Asset Inventory tracks resources, and Security Command Center provides threat detection but not specific compliance drift monitoring for Assured Workloads.

Answer

Cloud Asset Inventory

Answer

Security Command Center

Answer

Cloud Monitoring

Question 11

Which Google Cloud compliance certification is most relevant for a company that processes credit card transactions and needs to demonstrate secure handling of cardholder data?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard, specifically for organizations that handle credit card data. ISO 27001 is an information security management standard, SOC reports are for service organization controls, and FedRAMP is for federal cloud computing.

Answer

SOC 2 Type II

Answer

ISO 27001

Answer

FedRAMP

Question 12

A company wants to encrypt data at rest in Cloud Storage using their own keys. Which Cloud service should they use to manage these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud Key Management Service (Cloud KMS) allows customers to create, rotate, and manage their own encryption keys. Cloud HSM provides hardware security module-backed keys, but Cloud KMS is the management service. Cloud DLP is for data loss prevention, and Secret Manager is for storing secrets like API keys.

Answer

Cloud Data Loss Prevention (Cloud DLP)

Answer

Secret Manager

Answer

Cloud HSM

Question 13

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated and that only authorized services can communicate. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud Armor. VPC Service Controls create a secure perimeter around the CDE resources, preventing data exfiltration. Cloud Armor provides web application firewall capabilities to protect the application. Cloud NAT is for outbound connectivity, Cloud IDS is for intrusion detection, and Cloud VPN is for site-to-site VPN, not isolation.

Answer

Cloud IDS

Answer

Cloud NAT

Answer

Cloud VPN

Question 14

A financial institution needs to comply with GDPR data subject rights. They must ensure that personal data in BigQuery can be anonymized for analytics while still allowing joins on pseudonymized identifiers. Which THREE services or features should they consider? (Choose 3)

Accepted Answer

Cloud Dataflow. Cloud DLP can be used to pseudonymize data (e.g., tokenize). BigQuery's SQL functions like `DLP_TOKENIZE` allow on-the-fly pseudonymization. Cloud Dataflow can be used to pre-process data. Cloud KMS encrypts but does not pseudonymize. Cloud Functions can be used but is less integrated. Cloud Storage is for storage, not processing.

Answer

Cloud Functions

Answer

Cloud KMS

Question 15

A company is using Assured Workloads with the FEDRAMP_HIGH regime. They need to restrict where resources can be created and monitor for compliance violations. Which TWO settings should they configure? (Choose 2)

Accepted Answer

Resource location restrictions. Resource location restrictions limit the regions where resources can be deployed. Compliance monitoring (or compliance drift monitoring) alerts when resources violate policies. Google personnel access restrictions control internal access, and Access Transparency logs provide logs. Data residency is similar to resource location.

Answer

Access Transparency logs

Answer

Data residency controls

Answer

Google personnel access restrictions