PCSE Supporting Compliance Requirements Practice Test 4 — 15 Questions

Question 1

Which Google Cloud compliance certification requires the customer to sign a Business Associate Agreement (BAA) with Google?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) requires covered entities and their business associates to sign a Business Associate Agreement (BAA) with Google when using Google Cloud services that may involve protected health information (PHI). Google Cloud offers a BAA for HIPAA compliance, and customers must accept it to use services in a HIPAA-compliant manner.

Answer

PCI DSS

Answer

SOC 2

Answer

FedRAMP

Question 2

A government contractor needs to deploy workloads on GCP that meet FedRAMP High baseline requirements. They want to enforce resource location restrictions and access controls for Google personnel. Which product should they use?

Accepted Answer

Assured Workloads. Assured Workloads is Google Cloud's purpose-built product for deploying workloads that must meet specific compliance frameworks, including FedRAMP High, FedRAMP Moderate, IL2–IL5, CJIS, ITAR, and HIPAA. It enforces data residency (resource location restrictions), personnel access controls (U.S.-person support only for FedRAMP High), and cryptographic controls automatically within a dedicated folder. This directly matches the contractor's requirement to enforce location restrictions and Google personnel access controls.

Answer

Cloud Security Command Center

Answer

VPC Service Controls

Answer

Organization Policies

Question 3

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Accepted Answer

Use Cloud External Key Manager (EKM) with a supported partner.. PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Answer

Use SHA-1 for SSL certificates.

Answer

Use default Google encryption keys (Google-managed) for data at rest.

Answer

Use TLS 1.0 for data in transit.

Question 4

A company processes healthcare data and has signed a BAA with Google Cloud. They need to implement controls for HIPAA compliance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Provide security awareness training to all workforce members.. Option A is correct because HIPAA's Security Rule requires workforce security and awareness training so that all personnel who handle ePHI understand their responsibilities and can recognize threats; Google Cloud's BAA does not remove this customer obligation. Option D is correct because HIPAA requires audit controls and the ability to record and examine activity in systems containing ePHI, so enabling access logging (e.g., Cloud Audit Logs for data access) on covered services provides the necessary audit trail for PHI access. Option E is correct because Cloud DLP can discover, classify, and de-identify PHI in Cloud Storage and BigQuery, supporting the HIPAA Privacy Rule's minimum necessary and de-identification requirements while reducing exposure of sensitive data. Option B is not required because CMEK is an optional data-at-rest control; Google Cloud already encrypts data by default and CMEK is not mandated by HIPAA. Option C is not required because Cloud Armor addresses DDoS/edge protection, which is a general security control rather than a specific HIPAA compliance requirement for processing PHI.

Answer

Enable Customer-Managed Encryption Keys (CMEK) for all services.

Answer

Use Cloud Armor to protect the web application from DDoS attacks.

Question 5

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) while maintaining HIPAA compliance. They have executed a Business Associate Agreement (BAA) with Google. Which additional step is required to ensure that PHI is properly classified and protected?

Accepted Answer

Use Cloud Data Loss Prevention (DLP) to inspect and classify storage buckets containing PHI.. Cloud DLP is the service designed to inspect, classify, and de-identify sensitive data such as PHI. After signing a BAA, the next step to ensure PHI is properly classified and protected is to use DLP to discover and label PHI in storage buckets, which enables appropriate controls. Audit logs, Cloud Armor, and VPC Service Controls are important but do not fulfill the classification requirement.

Answer

Enable Audit Logs for all services that process PHI.

Answer

Configure Cloud Armor to protect web applications handling PHI.

Answer

Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.

Question 6

A company needs to ensure that all data stored in Cloud Storage is encrypted at rest using keys that they generate and manage themselves. They also need to rotate the keys every 90 days. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Customer-managed encryption keys (CMEK) using Cloud KMS allow the customer to generate, manage, and rotate keys themselves. Cloud KMS supports automatic rotation schedules (e.g., every 90 days), and CMEK integrates with Cloud Storage to encrypt data at rest with those keys. This meets the requirement for self-managed keys with rotation.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Google-managed encryption keys (GMEK)

Question 7

A security engineer needs to audit changes to IAM policies across their Google Cloud organization. Which audit log type should they enable to capture IAM policy changes?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record changes to resource configurations and metadata, including IAM policy changes such as creating, modifying, or deleting roles, bindings, and service accounts. They are enabled by default and are the correct log type for auditing who changed IAM policies and when. This makes them the authoritative source for configuration-change auditing.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

Access Transparency logs

Question 8

Which Google Cloud service is specifically designed to help customers meet compliance requirements by creating a folder with pre-defined organization policies, resource location restrictions, and access controls?

Accepted Answer

Assured Workloads. Assured Workloads is Google Cloud's purpose-built service for creating folders pre-configured with compliance controls — including organization policies, resource location restrictions, personnel access controls, and encryption requirements — tailored to specific regimes like FedRAMP, IL4, ITAR, CJIS, and HIPAA. It provisions a folder with these guardrails so workloads inherit compliance posture automatically.

Answer

VPC Service Controls

Answer

Cloud HSM

Answer

Security Command Center

Question 9

A security team wants to monitor for compliance drift in an Assured Workloads folder that enforces FedRAMP High controls. Which Google Cloud service should they use to detect violations of organization policies?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform, and it includes the Assured Workloads and organization policy violation detectors that surface compliance drift in regulated folders such as FedRAMP High. SCC Premium/Enterprise tiers provide continuous monitoring, compliance dashboards, and findings for policy violations, making it the correct service to detect drift.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

Cloud Audit Logs

Question 10

A company is required to perform penetration testing on their Google Cloud infrastructure. According to Google Cloud's policy, which statement is true regarding penetration testing?

Accepted Answer

No prior approval is needed for testing most services, but denial-of-service (DoS) attacks are not permitted.. Google Cloud's penetration testing policy explicitly states that customers do not need prior approval for testing most Google Cloud services, but denial-of-service (DoS) attacks, DNS spoofing, and other disruptive activities are prohibited. This permissive stance allows organizations to conduct security assessments without bureaucratic delays while protecting Google's shared infrastructure. The policy applies to the customer's own projects and resources.

Answer

Customers must use Google's own penetration testing tools, such as Web Security Scanner.

Answer

Prior approval from Google is required for all penetration testing activities.

Answer

Penetration testing is prohibited on Google Cloud unless it is conducted by a certified third party.

Question 11

A company is designing a PCI DSS-compliant environment on Google Cloud. They need to isolate the cardholder data environment (CDE) and log all access to it. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place all CDE resources in a dedicated VPC.. Option A is correct because placing all CDE resources in a dedicated VPC provides network-level isolation and segmentation from non-CDE workloads, which PCI DSS requires to prevent cardholder data from being exposed to out-of-scope systems. Option B is correct because VPC Service Controls creates a service perimeter around the CDE project, restricting data exfiltration and unauthorized access to Google Cloud APIs and services, directly supporting CDE isolation. Option C is correct because enabling Data Access audit logs for all CDE services records every read/write access to cardholder data, satisfying PCI DSS requirement 10 to log all access to system components and cardholder data. Option D is not correct because SSL policies on Cloud Load Balancing enforce TLS versions/ciphers for traffic termination but do not isolate the CDE or log access to it. Option E is not correct because Cloud Armor WAF protects web applications from external attacks but does not by itself isolate the CDE or provide the required access logging.

Answer

Use Cloud Load Balancing with SSL policies to enforce TLS 1.3.

Answer

Deploy Cloud Armor WAF to protect web applications in the CDE.

Question 12

A multinational company must comply with GDPR and needs to ensure that personal data is processed in a manner that respects data subject rights. Which TWO of the following are required under GDPR? (Choose 2)

Accepted Answer

Provide data subjects with a copy of their personal data upon request (right of access).. Option C is correct because GDPR Article 15 grants data subjects the right of access, requiring the controller to provide a copy of their personal data free of charge within one month of the request. Option D is correct because GDPR Article 25 mandates data protection by design and by default, meaning privacy safeguards must be built into processing activities and systems from the outset, with only data necessary for each purpose processed by default. Option A is incorrect because the right to erasure under Article 17 is not absolute; exceptions exist, such as when processing is necessary for legal compliance, public interest, or the establishment/exercise/defense of legal claims. Option B is incorrect because GDPR does not require data to be stored only in the data subject's region; cross-border transfers are permitted under mechanisms like adequacy decisions, Standard Contractual Clauses, or Binding Corporate Rules. Option E is incorrect because GDPR does not mandate specific algorithms or protocols like AES-256 and TLS 1.3; it requires appropriate technical and organizational measures, leaving the choice of encryption standards to risk assessment.

Answer

Delete personal data immediately upon request without any exceptions.

Answer

Store personal data only in the region where the data subject resides.

Answer

Encrypt all personal data at rest and in transit using AES-256 and TLS 1.3.

Question 13

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) in Cloud Storage. They have signed a Business Associate Agreement (BAA) with Google. Which additional step is REQUIRED to ensure HIPAA compliance for the data stored?

Accepted Answer

No additional action is required; Cloud Storage is HIPAA-eligible and encrypts data at rest by default.. Cloud Storage is a HIPAA-eligible service under Google Cloud's BAA, and it encrypts all data at rest by default using AES-256. Once a BAA is in place, no additional configuration is strictly required to store PHI in Cloud Storage from a HIPAA compliance standpoint — encryption at rest and in transit is automatic. Organizations may choose CMEK or other controls for policy reasons, but they are not required for HIPAA eligibility.

Answer

Use Customer-Managed Encryption Keys (CMEK) for the bucket.

Answer

Configure the bucket to be in a VPC with no public access.

Answer

Enable Object Versioning on the bucket.

Question 14

A financial institution is deploying a PCI DSS-compliant web application on Google Cloud. They need to isolate the cardholder data environment (CDE) from other environments and protect the web application against common web attacks. Which combination of services meets these requirements?

Accepted Answer

VPC Service Controls and Cloud Armor. VPC Service Controls create a perimeter around Google Cloud resources to prevent data exfiltration. Cloud Armor is a web application firewall that protects against OWASP Top 10 attacks. Together they isolate the CDE and protect the application. Cloud IDS is for network threat detection, not isolation. Cloud NAT provides outbound internet access, not security. Cloud Load Balancing distributes traffic but does not isolate.

Answer

Cloud NAT and Cloud IDS

Answer

Identity-Aware Proxy (IAP) and Cloud Storage

Answer

Shared VPC and Cloud Load Balancing

Question 15

A company is using Assured Workloads to enforce FEDRAMP_HIGH compliance. They need to ensure that only US-based personnel from Google can access their data. Which configuration setting within the Assured Workloads folder should they enable?

Accepted Answer

Google personnel access restrictions. Google personnel access restrictions is the Assured Workloads control specifically designed to limit access to customer data by Google personnel to those located in the compliance regime's required geography (e.g., US persons for FEDRAMP_HIGH). Enabling it ensures that only US-based Google support and operations staff can access the data, satisfying the personnel residency requirement. This control is part of the Assured Workloads folder configuration and is required for certain regimes like FEDRAMP_HIGH and ITAR.

Answer

Access Transparency logs

Answer

Resource location restrictions

Answer

Key Access Justification (KAJ) logs