PCSE Supporting Compliance Requirements — Timed 15 Questions

Question 1

A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP can inspect Cloud Storage buckets for sensitive data like PHI and redact or de-identify it automatically using its inspect and transform pipeline.

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Security Command Center

Question 2

A company needs to retain audit logs for 7 years to meet compliance requirements. By default, Cloud Audit Logs are retained for 30 days. What should they do to retain the logs for 7 years?

Accepted Answer

Create a log sink to export audit logs to a Cloud Storage bucket with a retention policy set to 7 years.. Log Sinks can route logs to Cloud Storage Buckets, which support retention policies. Object Retention Lock can enforce WORM compliance if required.

Answer

Increase the default audit log retention period in the Logging settings to 7 years.

Answer

Enable Logging export to BigQuery and set table expiration to 7 years.

Answer

Use Cloud Functions to copy audit logs daily to Coldline Storage.

Question 3

A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?

Accepted Answer

Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.. VPC Service Controls provide a perimeter that prevents data exfiltration from managed services, while GKE network policies enforce pod-level isolation. Both are recommended for PCI DSS CDE isolation.

Answer

Use Cloud Armor to inspect all traffic and block non-compliant requests.

Answer

Enable Data Loss Prevention to scan payment data and restrict access.

Answer

Deploy the CDE in a separate project and use IAM roles to restrict access.

Question 4

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

Accepted Answer

Assured Workloads. Assured Workloads includes Access Transparency and Access Approval controls to restrict Google personnel access. When creating an Assured Workload with ITAR regime, these controls are enabled by default.

Answer

IAM Conditions

Answer

VPC Service Controls

Answer

Cloud HSM

Question 5

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

Accepted Answer

Bucket locking with a retention policy. Object Retention Lock allows you to set a retention policy on a bucket that prevents object deletion or modification until the retention period expires. This is a WORM (Write Once, Read Many) capability.

Answer

Lifecycle management rules

Answer

Object versioning

Question 6

A company processes personal data of European Union residents on GCP. They need to ensure that data processing is limited to specific purposes and that data subjects can exercise their rights (access, rectification, erasure). Which actions should they take to comply with GDPR?

Accepted Answer

Sign a DPA with Google, implement data subject request workflows, and use Cloud DLP to classify personal data.. To comply with GDPR, the company must sign a Data Processing Agreement (DPA) with Google, implement data subject rights (like deletion), and document processing purposes. Encryption is encouraged but not a specific GDPR requirement listed in the options.

Answer

Use Assured Workloads with EU Regions and Support and enable Access Transparency.

Answer

Enable data encryption with CMEK and sign a DPA with Google.

Answer

Enable VPC Service Controls and restrict data access to EU regions.

Question 7

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud does not require prior approval for penetration testing of most services, but Denial of Service (DoS) testing is explicitly prohibited.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.

Question 8

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

Accepted Answer

Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.. BigQuery audit logs are immutable and cannot be deleted individually. The recommended approach is to export logs to Cloud Storage and use log sinks to filter out or redact personal data before storage.

Answer

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Answer

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Answer

Set a table expiration on the audit logs dataset to delete all logs after a short period.

Question 9

Which Google Cloud compliance certification requires the customer to sign a Business Associate Agreement (BAA) with Google?

Accepted Answer

HIPAA. HIPAA requires a BAA between a covered entity (or business associate) and Google Cloud before processing Protected Health Information (PHI).

Answer

PCI DSS

Answer

SOC 2

Answer

FedRAMP

Question 10

A government contractor needs to deploy workloads on GCP that meet FedRAMP High baseline requirements. They want to enforce resource location restrictions and access controls for Google personnel. Which product should they use?

Accepted Answer

Assured Workloads. Assured Workloads provides compliance-focused folders that enforce location restrictions, personnel access controls, and other controls specific to the chosen regime (e.g., FedRAMP High).

Answer

Cloud Security Command Center

Answer

VPC Service Controls

Answer

Organization Policies

Question 11

Which of the following is a customer responsibility under the Google Cloud shared responsibility model?

Accepted Answer

Encryption of data at rest and in transit. The shared responsibility model assigns physical security, hardware, and hypervisor security to Google; the customer is responsible for data encryption, IAM, network controls, and application security.

Answer

Physical security of data centers

Answer

Hardware maintenance

Answer

Hypervisor security

Question 12

A company wants to enforce that all Cloud Storage buckets created in their organization have a retention policy for compliance. If a bucket is created without a retention policy, it should be automatically remediated. Which approach should they use?

Accepted Answer

Use an Organization Policy with a constraint to require a retention policy on all buckets and use Cloud Asset Inventory to enforce remediation.. Organization policies with a constraint can enforce that all buckets have a retention policy. However, if a bucket is created without one, Cloud Asset Inventory can detect the violation and trigger a Cloud Function to apply a default retention policy.

Answer

Use Cloud DLP to scan buckets and add retention policies automatically.

Answer

Use Security Command Center to find non-compliant buckets and manually apply retention policies.

Answer

Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.

Question 13

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Accepted Answer

Use Cloud External Key Manager (EKM) with a supported partner.. PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Answer

Use SHA-1 for SSL certificates.

Answer

Use default Google encryption keys (Google-managed) for data at rest.

Answer

Use TLS 1.0 for data in transit.

Question 14

An organization must comply with ITAR regulations. They use Assured Workloads with the ITAR regime. Which THREE controls are automatically enforced by this regime? (Choose three.)

Accepted Answer

Use of Customer-Managed Encryption Keys (CMEK) for applicable services. Assured Workloads for ITAR enforces data residency, personnel access restrictions, and encryption with CMEK. VPC Service Controls, while important, are not automatically enforced by the regime itself but can be added separately.

Answer

VPC Service Controls automatically configured

Answer

Cloud Audit Logs retention set to 10 years

Question 15

A company processes healthcare data and has signed a BAA with Google Cloud. They need to implement controls for HIPAA compliance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Provide security awareness training to all workforce members.. HIPAA requires workforce training, access logging for covered services, and data classification to identify PHI. CMEK is optional; Cloud Armor is for web application security but not specifically required by HIPAA.

Answer

Enable Customer-Managed Encryption Keys (CMEK) for all services.

Answer

Use Cloud Armor to protect the web application from DDoS attacks.