PCSE Supporting Compliance Requirements Practice Test 5 — 15 Questions

Question 1

A healthcare organization is migrating PHI workloads to Google Cloud and needs to encrypt data at rest with keys that are generated and managed within their own on-premises hardware security module (HSM). Which encryption approach should they use?

Accepted Answer

Enable Cloud External Key Manager (Cloud EKM).. Cloud External Key Manager (Cloud EKM) allows you to manage encryption keys in an external key management system that is FIPS 140-2 Level 3 validated, including on-premises HSMs. CSEK requires you to supply your own keys but Google manages them on the server side. CMEK uses Cloud KMS keys, which can be generated in Cloud HSM, but the keys remain under Google's control. AES-256 encryption is the default Google-managed encryption, which does not meet the requirement for customer-managed keys on an on-premises HSM.

Answer

Apply default Google-managed AES-256 encryption.

Answer

Use Cloud Key Management Service (Cloud KMS) with Cloud HSM to generate keys.

Answer

Use customer-supplied encryption keys (CSEK).

Question 2

A company needs to retain critical financial records for 7 years to comply with SEC regulations. They choose to store the records in Cloud Storage. Which feature should they enable to ensure the records cannot be deleted or overwritten before the retention period expires?

Accepted Answer

Apply a retention policy and lock the bucket using Bucket Lock.. Object Retention Lock in Cloud Storage allows you to set a retention policy on a bucket, which uses a WORM (Write Once Read Many) model. Once an object is stored, it cannot be deleted or overwritten until the retention period expires. Bucket Lock locks the retention policy, preventing changes. IAM conditions and lifecycle rules do not enforce immutability.

Answer

Enable bucket-level IAM conditions.

Answer

Configure an object lifecycle rule to delete objects after 7 years.

Answer

Use Cloud KMS to encrypt objects and destroy the key after 7 years.

Question 3

A multinational company is using Assured Workloads to meet EU_Regions_and_Support compliance. They need to ensure that only EU-based Google personnel can access the customer's data for support purposes. Which configuration should they enable?

Accepted Answer

Turn on 'Access Approvals' and set personnel restrictions to EU.. Within Assured Workloads, the 'Google personnel access restrictions' option restricts support access to Google personnel located in specific regions. For EU regimes, this is set to EU. VPC Service Controls prevent data exfiltration but do not control personnel access. Access Transparency logs show actions, but do not restrict them. Data residency restrictions keep data in specific regions but do not limit Google personnel access.

Answer

Configure Access Transparency and log all support actions.

Answer

Enable VPC Service Controls to restrict data movement.

Answer

Apply data residency restrictions in the Assured Workloads folder.

Question 4

A financial institution is deploying a PCI DSS-compliant cardholder data environment (CDE) on Google Cloud. They need to segment the CDE from other environments and restrict data egress from the CDE. Which two services should they use together? (Choose the best combination.)

Accepted Answer

VPCs and VPC Service Controls. For PCI DSS network segmentation, VPCs provide network isolation, and VPC Service Controls enforce perimeter security by preventing data egress from the CDE to unauthorized destinations. Cloud NAT provides outbound internet access but does not restrict egress. Cloud Armor is a WAF for inbound traffic. Cloud VPN connects on-premises but does not segment.

Answer

Cloud VPN and VPC Service Controls

Answer

VPCs and Cloud NAT

Answer

VPC Service Controls and Cloud Armor

Question 5

An organization wants to run a penetration test on their Google Cloud environment to validate security controls. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Customers can conduct penetration testing without prior approval, but must avoid DoS attacks.. Google's Acceptable Use Policy allows customers to conduct penetration testing on their own infrastructure without prior approval for most services, but they prohibit denial of service (DoS) testing. Tests must follow the policy guidelines. No prior approval is needed, but DoS testing is forbidden.

Answer

Denial of Service (DoS) testing is permitted as long as it targets only customer-owned IPs.

Answer

All penetration tests require prior approval from Google Cloud support.

Answer

Penetration testing is only allowed on Compute Engine, not on managed services like Cloud SQL.

Question 6

A company that stores protected health information (PHI) in Google Cloud wants to run a BigQuery query to identify and classify sensitive data such as patient names and social security numbers. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP). Cloud Data Loss Prevention (Cloud DLP) is specifically designed to inspect, classify, and de-identify sensitive data. It can be used to scan BigQuery tables and other data sources for PHI, PII, and other sensitive content. Cloud Audit Logs track access, BigQuery itself does not classify data, and Cloud KMS manages encryption keys.

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (Cloud KMS)

Answer

BigQuery's built-in data classification

Question 7

An organization subject to GDPR receives a data subject request for erasure ('right to be forgotten'). The data subject's information is stored in BigQuery audit logs. What is the implication for the audit logs, and what should the organization do?

Accepted Answer

Use Cloud DLP to redact the personal data from the audit logs, and store the redacted version.. BigQuery audit logs are immutable by default for compliance reasons. You cannot delete individual entries. The recommended approach is to redact the personal data from the logs using Cloud DLP or to export logs to Cloud Storage and then delete the export. Deleting the entire log sink would affect future logging but not existing logs. The logs cannot be edited.

Answer

Delete the entire log bucket containing the audit logs.

Answer

Delete the BigQuery dataset containing the logs.

Answer

Edit the audit log entries directly using the Cloud Logging API.

Question 8

A company using Assured Workloads with the FedRAMP High compliance regime wants to monitor for configuration changes that could cause the environment to become non-compliant. Which tool should they use to detect compliance drift?

Accepted Answer

Assured Workloads Compliance Status dashboard. Assured Workloads provides a Compliance Status dashboard that shows the compliance state of the folder. It monitors for policy violations and configuration drifts that could affect compliance. Security Command Center provides security posture, but not specifically compliance drift for Assured Workloads. Cloud Monitoring monitors metrics, not compliance. Cloud Asset Inventory tracks resources but does not evaluate compliance against a regime.

Answer

Security Command Center

Answer

Cloud Monitoring

Answer

Cloud Asset Inventory

Question 9

A company is implementing a HIPAA-compliant environment on Google Cloud. They need to ensure that all access to protected health information (PHI) is logged and monitored. Which TWO steps should they take? (Choose two.)

Accepted Answer

Set up Cloud Logging-based alerts for suspicious access patterns.. HIPAA requires logging of access to PHI. Enabling Cloud Audit Logs for covered services and using Cloud Logging to monitor and set alerts on access patterns are key steps. VPC Service Controls restrict data movement but do not log access. Cloud DLP is for data classification, not logging. Cloud NAT provides outbound internet access, which is not related to logging.

Answer

Use Cloud DLP to automatically classify PHI in logs.

Answer

Configure VPC Service Controls to restrict PHI data egress.

Answer

Deploy Cloud NAT for outbound traffic from PHI instances.

Question 10

A company subject to PCI DSS is building a cardholder data environment (CDE) on Google Cloud. They need to encrypt cardholder data at rest and in transit. Which THREE measures should they implement? (Choose three.)

Accepted Answer

Enforce TLS 1.2 or higher for data in transit.. PCI DSS requires strong encryption. CMEK allows customer-managed keys for at-rest encryption. TLS 1.2 or higher encrypts data in transit. Cloud KMS is used to manage encryption keys. Cloud Armor is a WAF, not encryption. VPC Service Controls provide network segmentation, not encryption. Cloud HSM is a hardware-backed key storage, but the question asks for measures that encrypt data; CMEK, TLS, and Cloud KMS are directly related to encryption.

Answer

Configure Cloud Armor WAF to inspect traffic.

Answer

Use VPC Service Controls to isolate the CDE.

Question 11

A company uses Assured Workloads with the FEDRAMP_HIGH regime. They want to enforce resource location restrictions and restrict Google personnel access. Which TWO capabilities should they enable? (Choose two.)

Accepted Answer

Data residency restrictions in the Assured Workloads folder.. Assured Workloads provides data residency controls to ensure resources are deployed in specific regions, and it offers Google personnel access restrictions to limit support access to authorized personnel. Access Transparency logs actions but does not restrict. VPC Service Controls are separate from Assured Workloads. Cloud KMS is for key management.

Answer

VPC Service Controls.

Answer

Access Transparency logs.

Answer

Cloud KMS to manage encryption keys.

Question 12

A company needs to comply with GDPR requirements for data subject rights. They must be able to provide data subjects with access to their personal data and rectify inaccuracies. Which TWO Google Cloud services can assist with these requirements? (Choose two.)

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP). Cloud DLP can be used to locate and classify personal data across Google Cloud services, helping to fulfill data subject access requests. BigQuery can be used to query and analyze data, allowing retrieval of personal data for access requests. Cloud Audit Logs track access but do not provide data. Cloud Storage is a storage service but does not directly assist with access/rectification. Cloud KMS is for key management.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Audit Logs

Answer

Cloud Storage

Question 13

A company is implementing a data retention policy to comply with regulatory requirements. They need to retain certain BigQuery data for 7 years and ensure it cannot be deleted before the retention period ends. Which THREE steps should they take? (Choose three.)

Accepted Answer

Set a retention policy on the BigQuery dataset to prevent accidental deletion.. BigQuery does not have native retention locks like Cloud Storage. One approach is to export data to Cloud Storage and apply a retention policy with Bucket Lock. For data that remains in BigQuery, you can use IAM conditions to restrict deletion, set dataset retention policies, and use Cloud Audit Logs to monitor deletion attempts. Deleting the dataset after 7 years can be automated via lifecycle rules in Cloud Storage, but the question asks for steps to prevent premature deletion.

Answer

Use Cloud KMS to encrypt the data and destroy the key after 7 years.

Answer

Enable object lifecycle management to delete data after 7 years.

Question 14

A company is designing a PCI DSS-compliant architecture on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated from other environments and that all access to the CDE is logged. Which THREE controls should they implement? (Choose three.)

Accepted Answer

Separate VPC networks for the CDE and non-CDE environments.. VPC Service Controls provide a security perimeter around the CDE, preventing data exfiltration. VPC networks provide network isolation. Cloud Audit Logs record all access to resources. Cloud Armor is a WAF for inbound traffic. Cloud NAT provides outbound internet. Cloud KMS manages encryption keys.

Answer

Cloud NAT to allow outbound internet access from the CDE.

Answer

Cloud Armor WAF to protect web applications in the CDE.

Question 15

A company is subject to SOC 2 compliance and wants to demonstrate that they have implemented proper access controls on Google Cloud. Which TWO IAM best practices should they follow? (Choose two.)

Accepted Answer

Enable multi-factor authentication for all users.. SOC 2 requires access controls. The principle of least privilege (granting minimal permissions) and enabling multi-factor authentication (MFA) are key IAM best practices. Using predefined roles is not always best; custom roles may be needed. Service accounts are for applications, not user access. Cloud Audit Logs track access but are not an IAM best practice per se.

Answer

Use only predefined roles to ensure consistency.

Answer

Enable Cloud Audit Logs to monitor access.

Answer

Use service accounts for human user access.