PCSE Supporting Compliance Requirements Practice Test 7 — 15 Questions

Question 1

A healthcare analytics company runs workloads on Google Cloud and must demonstrate HIPAA compliance to auditors. The security team needs a Google-provided artifact that documents how Google's infrastructure controls map to HIPAA requirements so they can incorporate it into their own compliance documentation. Which resource should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Google Cloud Compliance Reports Manager, which provides on-demand access to audit reports, certifications, and the HIPAA mapping documentation for Google Cloud services.. Compliance Reports Manager is the designated Google Cloud portal for retrieving third-party audit reports, certifications, and framework mappings such as the HIPAA documentation. Because the healthcare company must show auditors how Google's infrastructure controls correspond to HIPAA requirements, this is the only listed resource that actually contains provider attestation artifacts rather than operational telemetry or design guidance.

Answer

The Cloud Asset Inventory API, which exports a list of all resources and their IAM policies across the organization.

Answer

The Google Cloud Status Dashboard, which publishes incident and outage history for each region and service.

Answer

The Google Cloud Architecture Framework, which describes recommended design pillars for reliability, security, and cost optimization.

Question 2

A company is preparing for a SOC 2 audit and needs to demonstrate that changes to production Google Cloud resources are tracked and approved. They want to ensure that all modifications to IAM policies, firewall rules, and Cloud Storage buckets are logged and that the logs cannot be altered. Which Google Cloud service should they use to collect and retain these logs immutably?

Accepted Answer

Cloud Logging with log buckets and retention locks. Cloud Logging automatically records Admin Activity logs for all resource changes. By routing these logs to a dedicated log bucket and applying a retention lock, you ensure the logs are immutable for a specified period. This meets SOC 2 requirements for tracking changes and preserving tamper-proof audit trails. The retention lock prevents even project owners from deleting the logs prematurely.

Answer

Cloud Monitoring dashboards with alerting on configuration changes

Answer

Security Command Center findings exported to BigQuery

Answer

Cloud Audit Logs exported to Cloud Storage with Object Lifecycle Management

Question 3

A multinational bank must prove that its Google Cloud resources for a regulated trading platform remain in Canadian regions only, and it needs continuous monitoring that alerts when any resource is deployed outside the allowed locations. The team wants a managed Google Cloud capability rather than custom scripts. What should they implement?

Accepted Answer

Create an organization policy with the location restriction constraint (gcp.resourceLocations) set to allow only canadian-locations, and monitor violations through the Organization Policy audit logs.. Organization policy constraints are the managed, preventive mechanism for enforcing resource locations, and the gcp.resourceLocations constraint specifically restricts creation to approved regions. Because enforcement attempts are recorded in audit logs, the bank gains continuous detection of out-of-region attempts without writing custom scripts, combining prevention with the monitoring evidence auditors expect for data residency.

Answer

Apply resource labels indicating the approved region and build log-based alerts on label changes using Cloud Monitoring.

Answer

Use Cloud DNS routing policies to restrict name resolution to Canadian endpoints and alert on resolution failures.

Answer

Deploy VPC Service Controls perimeters around the projects and rely on the perimeter violation dashboards in Cloud Logging.

Question 4

A financial services company must comply with the Payment Card Industry Data Security Standard (PCI DSS) on Google Cloud. They need to ensure that cardholder data is protected both at rest and in transit. Which two Google Cloud configurations should they implement to meet these requirements? (Choose two.)

Accepted Answer

Enforce TLS 1.2+ for all internal and external communications. To meet PCI DSS for protecting cardholder data, you must encrypt data at rest and in transit. Enabling CMEK gives you control over encryption keys for data at rest, satisfying key management requirements. Enforcing TLS 1.2+ ensures data in transit is encrypted with strong protocols. Together, these address the core encryption requirements for PCI DSS compliance on Google Cloud.

Answer

Store all cardholder data in BigQuery with default encryption

Answer

Configure VPC Service Controls perimeters around cardholder data services

Answer

Use Cloud Armor to block traffic from high-risk countries

Question 5

A software company plans to store EU customer personal data in Cloud Storage and BigQuery under a Data Processing Addendum with Google. The legal team asks the security engineer which Google Cloud commitment guarantees that customer data will not be accessed for advertising purposes and will be handled only per the customer's instructions. What should the engineer cite?

Accepted Answer

The Google Cloud Data Processing and Security Terms, which contractually commit Google to process customer data only per documented instructions and not for advertising.. The Data Processing and Security Terms are incorporated by reference into Google Cloud contracts and set out Google's processor obligations, including acting only on documented customer instructions and not using customer data for advertising. For a DPA-driven question about EU personal data in Cloud Storage and BigQuery, this is the authoritative commitment the security engineer should supply to legal.

Answer

The Google Cloud Privacy Notice, which explains what data Google collects about users of its websites and products.

Answer

The Google Cloud Service Level Agreement, which defines uptime commitments and financial credits for availability shortfalls.

Answer

The Google Cloud Acceptable Use Policy, which lists prohibited activities customers may not perform on the platform.

Question 6

A retail enterprise is preparing for a SOC 2 Type II audit of its Google Cloud environment. The security team must collect evidence that shows who changed firewall rules and IAM policies, and that shows whether privileged access was reviewed over the audit period. Which two Google Cloud capabilities should they use to gather this evidence? (Choose two.)

Accepted Answer

IAM policy and role usage reports from the Policy Analyzer, reviewed and signed off on a recurring schedule by the security team.. Audit evidence for SOC 2 needs two threads: an immutable record of configuration changes and a documented periodic review of privileged access. Exporting Admin Activity logs to a retention-locked bucket provides the first, capturing the principal and change details for firewall and IAM modifications. Policy Analyzer access queries with scheduled, signed-off reviews provide the second, demonstrating that access was actually evaluated during the audit period.

Answer

Access Transparency logs, which record when Google personnel access customer data or configuration.

Answer

IAM Recommender suggestions applied to service accounts to reduce unused permissions.

Answer

Cloud Monitoring uptime checks on the firewall and IAM endpoints to prove configuration integrity.

Question 7

A healthcare company stores electronic protected health information (ePHI) in Cloud Storage and BigQuery. During a compliance audit, they must demonstrate that access to ePHI is logged and that any modification to ePHI can be traced. Which Google Cloud feature should they enable to meet this requirement?

Accepted Answer

Cloud Audit Logs with Data Access audit logs enabled for Cloud Storage and BigQuery. Data Access audit logs capture read and write operations on ePHI, providing the necessary audit trail for HIPAA compliance. Other options are security controls but do not fulfill the logging and traceability requirement.

Answer

VPC Service Controls perimeter around the projects containing ePHI

Answer

Customer-managed encryption keys (CMEK) in Cloud KMS for Cloud Storage and BigQuery

Answer

Cloud DLP inspection jobs scheduled to scan for sensitive data

Question 8

Your organization runs a regulated workload on Google Cloud and must demonstrate compliance with ISO/IEC 27001 to an external auditor. The auditor requires an on-demand, point-in-time report showing which controls were in place and how Google Cloud infrastructure was configured during a specific audit period. Which Google Cloud resource should you use to provide this evidence?

Accepted Answer

The Google Cloud compliance reports available through the Compliance Reports Manager in the Google Cloud console.. Compliance Reports Manager is the designated Google Cloud service for accessing Google's own compliance certifications, including ISO/IEC 27001, SOC, and PCI DSS. It provides on-demand, auditor-ready documents that map Google's controls to recognized standards. The other options provide configuration data, security findings, or activity logs, none of which serve as formal attestations of compliance.

Answer

Cloud Asset Inventory with a saved query that exports all asset metadata for the audit period.

Answer

Security Command Center Premium findings filtered to the audit period.

Answer

Cloud Logging audit logs exported to BigQuery for the audit period.

Question 9

A healthcare company processes protected health information (PHI) on Google Cloud and must comply with HIPAA. They need to ensure that all data at rest in Cloud Storage, BigQuery, and Cloud SQL is encrypted with keys they control, and that key usage is logged for audit. Which combination of Google Cloud services should they implement to meet these requirements?

Accepted Answer

Cloud KMS with customer-managed encryption keys (CMEK) and Cloud Audit Logs for Cloud KMS.. To meet HIPAA requirements for customer-controlled encryption keys and auditable key usage across multiple data services, Cloud KMS with CMEK is the appropriate choice. CMEK integrates with Cloud Storage, BigQuery, and Cloud SQL, and Cloud Audit Logs for Cloud KMS record all key operations. This provides both the control and the audit evidence needed.

Answer

Customer-supplied encryption keys (CSEK) stored in Cloud Storage and Cloud Logging sinks.

Answer

Cloud HSM with automatically generated keys and VPC Service Controls.

Answer

Google-managed encryption keys and Access Transparency logs.

Question 10

A multinational corporation must ensure that its Google Cloud resources for a new application are deployed only in the European Union to comply with GDPR data residency requirements. The security team wants to enforce this automatically and receive alerts if any resource is created outside the allowed regions. Which Google Cloud service should they use?

Accepted Answer

Organization Policy Service with a location restriction constraint.. Organization Policy Service with the location restriction constraint is the most direct way to enforce that resources are only created in allowed EU regions. It applies at the organization, folder, or project level and prevents non-compliant resource creation. While Assured Workloads also supports data residency, it is tailored to specific compliance regimes and may not cover all services as flexibly.

Answer

VPC Service Controls with a perimeter around EU regions.

Answer

Assured Workloads with the EU Regions and Support control package.

Answer

Cloud Asset Inventory with a feed that monitors resource creation events.

Question 11

Your company must comply with the Payment Card Industry Data Security Standard (PCI DSS) for a new e-commerce application on Google Cloud. The security team needs to understand which aspects of PCI DSS compliance are Google's responsibility and which are theirs. According to the Google Cloud shared responsibility model, which of the following is a customer responsibility?

Accepted Answer

Configuration of firewall rules and identity and access management policies for the application.. Under the Google Cloud shared responsibility model, the customer is responsible for security in the cloud, which includes configuring firewall rules and IAM policies. Google is responsible for security of the cloud, covering physical security, hypervisor patching, and network infrastructure. Understanding this division is essential for PCI DSS compliance.

Answer

Patching the hypervisor that runs the Compute Engine virtual machines.

Answer

Physical security of the data centers that host the application.

Answer

Ensuring the physical network is redundant and fault-tolerant.

Question 12

A healthcare analytics company stores patient records in Cloud Storage and BigQuery. A compliance officer requires an automated, recurring scan of these data sources to discover sensitive data such as personally identifiable information (PII) and protected health information (PHI), and to produce findings that can be reviewed for audit. The security team wants minimal operational overhead and no custom code. Which Google Cloud service should they use to meet this requirement?

Accepted Answer

Sensitive Data Protection (Cloud DLP) discovery scans scheduled via the console or API. Recurring sensitive-data discovery across Cloud Storage and BigQuery is a native capability of Sensitive Data Protection. Scheduling scans produces findings that can be retained and reviewed for compliance audits, and the built-in infoType detectors avoid custom code. The other services either aggregate existing findings, require custom pipeline development, or enforce access boundaries rather than inspecting data content.

Answer

Cloud Security Command Center Premium findings export to BigQuery

Answer

Cloud Data Fusion pipeline with a custom regex-based transformation

Answer

VPC Service Controls perimeter with access level restrictions

Question 13

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR) and ensure that personal data of EU residents is not transferred outside the EU. They are using BigQuery for analytics and want to enforce that all datasets containing personal data are created only in EU regions. Which Google Cloud feature should they use to meet this requirement?

Accepted Answer

Organization Policy constraints with the 'constraints/gcp.resourceLocations' constraint set to EU regions.. The organization policy constraint 'constraints/gcp.resourceLocations' is designed to restrict resource creation to specific locations. By applying it at the organization or folder level and setting allowed locations to EU regions, you ensure that any attempt to create a BigQuery dataset outside those regions is denied. This provides a preventive control that enforces data residency for GDPR compliance.

Answer

BigQuery data location settings at the dataset level, configured manually by data engineers.

Answer

Cloud DLP with a job trigger that scans BigQuery datasets and de-identifies data that leaves the EU.

Answer

VPC Service Controls with a perimeter that includes BigQuery and restricts data access to EU regions.

Question 14

A multinational retailer must demonstrate to an auditor that its Google Cloud environment enforces data residency for a regulated workload in a specific jurisdiction. The security team wants Google Cloud to deploy and monitor the workload against a predefined control package aligned to that jurisdiction, including automatic monitoring for compliance violations. Which Google Cloud solution should they use?

Accepted Answer

Assured Workloads with a jurisdiction-specific control package. Assured Workloads is designed for regulated workloads that must meet jurisdiction-specific requirements. Selecting an appropriate control package enforces data residency and personnel access constraints and provides continuous monitoring for violations, giving auditors a clear compliance narrative. Organization Policy, VPC Service Controls, and Cloud Asset Inventory each address narrower concerns and do not by themselves deliver an aligned, monitored control package.

Answer

Cloud Asset Inventory with a custom compliance dashboard

Answer

VPC Service Controls with access levels based on corporate IP ranges

Answer

Organization Policy constraints that restrict resource locations

Question 15

A financial services firm is preparing for a compliance audit of its Google Cloud environment. The auditor asks for evidence that access to sensitive production projects is governed and that administrative actions are traceable. The security team needs to produce configuration and activity evidence from Google Cloud. (Choose two.)

Accepted Answer

Cloud Audit Logs Admin Activity entries showing IAM policy changes and resource configuration events. Cloud Audit Logs Admin Activity entries provide an immutable, retained record of administrative and configuration changes, while Cloud Asset Inventory exports capture the effective IAM bindings on projects and folders. Together they demonstrate both the current access configuration and the history of who changed it, which is exactly the evidence an auditor requests for access governance and traceability.

Answer

Security Command Center Premium vulnerability findings for Compute Engine instances

Answer

Cloud Monitoring uptime check history for production services

Answer

VPC Flow Logs showing accepted and rejected connections to production subnets