PCSE Supporting Compliance Requirements — Timed 10 Questions

Question 1

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

Accepted Answer

Bucket locking with a retention policy. Bucket locking with a retention policy is the correct answer because it enforces a WORM (Write Once, Read Many) model on Cloud Storage objects, preventing deletion or modification for a specified retention period. Once the retention policy is locked, even project owners cannot remove or shorten it, guaranteeing the 5-year immutability requirement. This is the only option that provides a policy-enforced, tamper-proof retention guarantee at the bucket level.

Answer

Lifecycle management rules

Answer

Object versioning

Answer

Object Retention Lock

Question 2

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

Accepted Answer

Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.. BigQuery audit logs are immutable and managed by Google Cloud Logging, so they cannot be edited or deleted in place with SQL. The correct GDPR-compliant approach is to route audit logs through a log sink that filters or redacts personal data before it lands in a destination such as Cloud Storage, preventing the data subject's information from being retained in the first place. This aligns with the principle of data minimization and avoids the immutability problem entirely.

Answer

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Answer

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Answer

Set a table expiration on the audit logs dataset to delete all logs after a short period.

Question 3

Which of the following is a customer responsibility under the Google Cloud shared responsibility model?

Accepted Answer

Encryption of data at rest and in transit. Under the Google Cloud shared responsibility model, Google secures the infrastructure (physical data centers, hardware, hypervisor, network), while the customer is responsible for securing their data and workloads — including encrypting data at rest and in transit, managing identities, and configuring access controls. Encryption of data at rest and in transit is explicitly a customer responsibility because the customer chooses the encryption method (Google-default, CMEK, CSEK, or client-side) and manages keys and TLS configurations.

Answer

Physical security of data centers

Answer

Hardware maintenance

Answer

Hypervisor security

Question 4

A company wants to enforce that all Cloud Storage buckets created in their organization have a retention policy for compliance. If a bucket is created without a retention policy, it should be automatically remediated. Which approach should they use?

Accepted Answer

Use an Organization Policy with a constraint to require a retention policy on all buckets and use Cloud Asset Inventory to enforce remediation.. Organization policies with a constraint can enforce that all buckets have a retention policy. However, if a bucket is created without one, Cloud Asset Inventory can detect the violation and trigger a Cloud Function to apply a default retention policy.

Answer

Use Cloud DLP to scan buckets and add retention policies automatically.

Answer

Use Security Command Center to find non-compliant buckets and manually apply retention policies.

Answer

Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.

Question 5

An organization must comply with ITAR regulations. They use Assured Workloads with the ITAR regime. Which THREE controls are automatically enforced by this regime? (Choose three.)

Accepted Answer

Use of Customer-Managed Encryption Keys (CMEK) for applicable services. Option B is correct because the Assured Workloads ITAR regime automatically enforces CMEK for supported services, ensuring encryption keys are managed by the customer within the compliance boundary. Option C is correct because ITAR requires that covered data remain within the United States, and the ITAR regime enforces US-only data residency by restricting resource locations to US regions. Option E is correct because the ITAR regime enables Access Transparency and Access Approval, which restrict and log Google personnel access to customer data, a key ITAR control. Option A is not correct because VPC Service Controls is not automatically configured by the ITAR regime; it is an optional additional control the customer may implement. Option D is not correct because Cloud Audit Logs retention is not set to 10 years by the ITAR regime; default log retention is 400 days and longer retention requires separate configuration.

Answer

VPC Service Controls automatically configured

Answer

Cloud Audit Logs retention set to 10 years

Question 6

A financial institution must store audit logs for 7 years to comply with PCI DSS requirements. By default, Cloud Audit Logs are retained for 30 days. What is the most cost-effective way to retain audit logs for 7 years?

Accepted Answer

Configure a log sink to export logs to Cloud Storage with a retention policy set to 7 years using Object Lifecycle Management.. The most cost-effective way to retain Cloud Audit Logs for 7 years is to configure a log sink that exports logs to a Cloud Storage bucket with a 7-year retention policy enforced via Object Lifecycle Management. Cloud Storage is significantly cheaper than retaining logs in Cloud Logging, and Object Lifecycle Management can automatically delete objects after 7 years, ensuring compliance without manual intervention. This approach decouples long-term retention from the default 30-day Cloud Logging retention.

Answer

Use Assured Workloads to automatically extend audit log retention to 7 years.

Answer

Create a log bucket with a retention period of 7 years using Log Analytics.

Answer

Increase the retention period for Cloud Audit Logs in the Logs Router to 7 years.

Question 7

A company subject to EU GDPR must implement the right to erasure (right to be forgotten) for personal data stored in BigQuery audit logs. The logs include query text that may contain personally identifiable information (PII). What is the correct approach to anonymize or delete PII from BigQuery audit logs?

Accepted Answer

Use Cloud DLP to scan and redact PII in the log entries as they are generated, and store redacted logs in BigQuery.. Cloud DLP can scan and redact PII in log entries as they are generated, ensuring that only de-identified data is stored in BigQuery. This satisfies GDPR's right to erasure by preventing PII from being persisted in the first place, while still retaining useful audit information. The redaction happens before storage, so deletion requests are inherently honored for future data.

Answer

Use Cloud Logging's exclusion filter to prevent PII from being logged in the first place.

Answer

Enable BigQuery table snapshot and restore to a point before the data was logged.

Answer

Delete the entire BigQuery dataset containing audit logs when a deletion request is received.

Question 8

A government contractor needs to deploy a workload on Google Cloud that complies with FedRAMP High and ITAR (International Traffic in Arms Regulations). They require that Google personnel cannot access the infrastructure and that data residency is restricted to the United States. Which Google Cloud solution should they use?

Accepted Answer

Assured Workloads with the FEDRAMP_HIGH and ITAR compliance regimes, and enable Google personnel access restrictions.. Assured Workloads is Google Cloud's purpose-built compliance framework that enforces regulatory controls at the folder level, including FedRAMP High and ITAR regimes. When you create an Assured Workloads folder with the ITAR regime, Google automatically applies data residency controls (US-only), personnel access restrictions (Google support personnel must be US persons with ITAR clearance), and other technical controls like CMEK and VPC Service Controls. This is the only option that directly addresses both the compliance certifications and the personnel access restriction requirement in a single managed solution.

Answer

VPC Service Controls with Organization Policies restricting resource location to the US.

Answer

Cloud HSM with Customer-Managed Encryption Keys (CMEK) stored in a US key region.

Answer

Deploy the workload in a Google Cloud region only available to US government customers (us-gov-west1).

Question 9

Which Google Cloud service provides the ability to enforce data retention policies on Cloud Storage objects to prevent deletion or modification for a specified duration?

Accepted Answer

Cloud Storage Object Retention Lock. Cloud Storage Object Retention Lock lets you set a retention period on individual objects during which they cannot be deleted or overwritten, enforcing data retention at the object level. This is the correct mechanism when the requirement is to prevent deletion or modification of specific objects for a specified duration. It is distinct from Bucket Lock, which applies a retention policy to an entire bucket.

Answer

Cloud Storage Bucket Lock

Answer

VPC Service Controls

Answer

Cloud Storage Object Lifecycle Management

Question 10

A company must process credit card transactions on Google Cloud and achieve PCI DSS compliance. They want to minimize the scope of the cardholder data environment (CDE). Which architectural approach should they take?

Accepted Answer

Create a separate VPC for the CDE, and route traffic through a dedicated project with VPC Service Controls and Private Google Access.. It isolates the CDE in its own VPC and project, which is the most effective way to minimize PCI DSS scope. VPC Service Controls add a security perimeter around Google Cloud services, preventing data exfiltration and unauthorized access, while Private Google Access allows internal-only communication with Google APIs without public IPs. This combination reduces the number of components that must be audited for PCI DSS, as the CDE is both network- and project-isolated.

Answer

Use separate VPCs for the CDE and non-CDE workloads, and connect them using VPC peering with firewall rules to restrict traffic.

Answer

Use a Shared VPC with a dedicated subnet for CDE resources and apply strict firewall rules.

Answer

Place all workloads in a single VPC and use Cloud Armor to protect the CDE.