PCSE Supporting Compliance Requirements Practice Test 4 — 15 Questions

Question 1

A healthcare organization is migrating workloads to Google Cloud and needs to process Protected Health Information (PHI) under HIPAA. Which step is required before storing PHI in any GCP service?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google Cloud. HIPAA requires a Business Associate Agreement (BAA) with Google Cloud before processing or storing PHI. The organization must sign a BAA with Google, which provides assurances regarding the protection of PHI.

Answer

Enable VPC Service Controls on all projects

Answer

Configure Cloud DLP to classify all data

Answer

Enable Cloud Audit Logs for all services

Question 2

A financial institution is required to retain records of all transactions for 7 years under regulatory compliance. They are using Cloud Storage for archive data and need to ensure that objects cannot be deleted or overwritten during the retention period. Which feature should they use?

Accepted Answer

Retention Policy with Retention Lock. Cloud Storage Object Retention Lock with a retention policy enforces a WORM (Write Once Read Many) state, preventing object deletion or modification for a specified duration. This meets regulatory retention requirements.

Answer

Object lifecycle management

Answer

Bucket-level IAM conditions

Answer

Bucket-level versioning

Question 3

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the Cardholder Data Environment (CDE) is isolated from other resources and that only authorized services can communicate with it. Which combination of controls should they implement?

Accepted Answer

Implement VPC Service Controls to define a perimeter around the CDE, and use VPC firewall rules to restrict traffic. VPC Service Controls create a security perimeter around the CDE, preventing data exfiltration. VPC firewalls control network traffic, and Cloud Armor provides WAF protection. Together, they meet PCI DSS isolation and security requirements.

Answer

Enable Cloud NAT for outbound internet access from the CDE

Answer

Use Shared VPC with a single network for all environments

Answer

Use Cloud Armor as the only security measure

Question 4

A company subject to GDPR receives a request from a data subject to delete all personal data from BigQuery audit logs. The logs contain query execution details with user identifiers. How can the company comply with the right to erasure (right to be forgotten)?

Accepted Answer

Use the Data Subject Request tool in Google Cloud to request erasure of the specific personal data from audit logs. BigQuery audit logs (Cloud Audit Logs) are immutable and cannot be deleted directly by customers. To comply with erasure requests, the company must use the Data Subject Request tool to request removal, as Google retains logs for 30 days and may need to remove them.

Answer

Create a log sink to export logs to Cloud Storage, then delete the sink and the exported objects

Answer

Delete the entire BigQuery dataset containing the logs

Answer

Use Cloud DLP to redact personally identifiable information from the logs

Question 5

A company using Google Cloud wants to conduct a penetration test on their infrastructure. According to Google's acceptable use policy, what must they do before testing?

Accepted Answer

Ensure that the tests do not include Denial of Service (DoS) attacks. Google's policy allows penetration testing on most services without prior approval, as long as the tests are not Denial of Service (DoS) attacks. This applies to common GCP services like Compute Engine, GKE, and Cloud Functions.

Answer

Create a separate VPC network for testing

Answer

Submit a request to Google support for each test

Answer

Enable VPC Flow Logs for monitoring

Question 6

A company handles Controlled Unclassified Information (CUI) and needs to deploy a workload that complies with ITAR (International Traffic in Arms Regulations). They plan to use Assured Workloads. Which compliance regime should they select when creating the Assured Workloads folder?

Accepted Answer

ITAR. For ITAR compliance, the correct regime is 'ITAR'. Assured Workloads supports multiple regimes including FedRAMP, HIPAA, and ITAR. Selecting ITAR enforces controls like personnel access restrictions and data location.

Answer

FEDRAMP_HIGH

Answer

CJIS

Answer

IL4

Question 7

A company is using BigQuery to store analytics data and wants to ensure that data is retained for exactly 365 days after ingestion, then automatically deleted. How can they achieve this with minimal operational overhead?

Accepted Answer

Set the table expiration to 365 days using the ALTER TABLE SET OPTIONS statement. BigQuery datasets have a default table expiration setting, but for individual tables, you can set an expiration time. The most efficient way is to set the table expiration to 365 days, which auto-deletes the table after that period.

Answer

Use Cloud Storage Object Lifecycle rules on the data exported to Cloud Storage

Answer

Create a Cloud Function to delete tables older than 365 days

Answer

Configure a BigQuery scheduled query to delete rows older than 365 days

Question 8

A company needs to store audit logs for a minimum of 5 years to meet compliance requirements. Cloud Logging retains logs for 30 days by default. Which approach should they take?

Accepted Answer

Create a log sink to export logs to Cloud Storage, and use Object Lifecycle Management to delete objects after 5 years. To retain logs for longer than 30 days, you must create a log sink that exports logs to a destination like Cloud Storage, and then set a retention policy on the bucket. Cloud Storage's Object Lifecycle Management can delete objects after 5 years.

Answer

Store logs in BigQuery and set table expiration to 5 years

Answer

Use Cloud Functions to periodically copy logs to a persistent disk

Answer

Enable the 'Log Retention' setting in Cloud Logging to 5 years

Question 9

A company has deployed an application in Assured Workloads with the FEDRAMP_HIGH compliance regime. They need to ensure that Google Cloud personnel cannot access their data. Which additional control should they enable?

Accepted Answer

Enable Google personnel access restrictions. Assured Workloads for FedRAMP High includes the option to enable Google personnel access restrictions, which blocks Google employees from accessing the customer's data. This is a key control for FedRAMP High compliance.

Answer

Enable Access Transparency logs

Answer

Enable CMEK for all services

Answer

Enable VPC Service Controls

Question 10

A company wants to ensure that data stored in Cloud Storage is encrypted at rest using keys that they generate and manage on-premises. Which encryption method should they use?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow you to provide your own encryption keys for Cloud Storage objects. Google discards the key after encryption/decryption, and you manage the key lifecycle.

Answer

Customer-Managed Encryption Keys (CMEK) using Cloud KMS

Answer

Google-managed encryption keys

Answer

Client-side encryption before uploading

Question 11

A company is subject to PCI DSS and needs to protect a web application that processes credit card data. They want to block common web attacks such as SQL injection and cross-site scripting (XSS). Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is a Web Application Firewall (WAF) that provides protections against OWASP Top 10 threats like SQL injection and XSS. It integrates with Cloud Load Balancing to filter traffic.

Answer

Cloud NAT

Answer

Cloud CDN

Answer

Identity-Aware Proxy (IAP)

Question 12

A company is using Assured Workloads to meet EU data residency requirements (EU_REGIONS_AND_SUPPORT). They want to monitor compliance drift when changes are made to the environment. Which service should they use?

Accepted Answer

Assured Workloads Compliance Monitoring. Assured Workloads Compliance Monitoring (part of Assured Workloads) continuously monitors the environment for compliance with the selected regime (e.g., data residency). It alerts on drift. Alternatively, Cloud Security Command Center (Cloud SCC) can be used, but the question asks for monitoring compliance drift specifically. The built-in monitoring in Assured Workloads is the correct answer.

Answer

Cloud Audit Logs

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Question 13

A company needs to implement data pseudonymisation to comply with GDPR. They are using BigQuery for analytics. Which TWO services can help them pseudonymise data in transit before it enters BigQuery?

Accepted Answer

Cloud Dataflow. Cloud DLP can inspect and de-identify data, including pseudonymisation (e.g., tokenization, masking). Dataflow can process streaming data and apply transformations using DLP templates. Together, they can pseudonymise data before loading into BigQuery.

Answer

Cloud Storage

Answer

Cloud SQL

Answer

Cloud Functions

Question 14

A company is deploying a workload that must comply with FedRAMP High. They are using Assured Workloads. Which THREE controls are automatically enabled when they select the FEDRAMP_HIGH regime?

Accepted Answer

Google personnel access restrictions. Assured Workloads for FedRAMP High enforces resource location restrictions (data must stay in the US), access controls (Google personnel access restrictions are available), and compliance monitoring (continuous compliance monitoring). These are key controls for FedRAMP High.

Answer

VPC Service Controls

Answer

Cloud Armor WAF

Question 15

A company is implementing PCI DSS compliance on Google Cloud. They need to ensure that cardholder data is encrypted in transit and at rest. Which TWO encryption controls are required by PCI DSS?

Accepted Answer

Use TLS 1.2 or higher for all data in transit. PCI DSS requires strong encryption for data in transit (TLS 1.2 or higher) and for data at rest (e.g., using encryption keys managed by the customer or Google). CMEK ensures customer-managed keys for data at rest.

Answer

Enable Cloud CDN

Answer

Use Cloud NAT

Answer

Enable VPC Flow Logs