PCSE Supporting Compliance Requirements — Timed 15 Questions

Question 1

A company is deploying a workload that must comply with FedRAMP High. They are using Assured Workloads. Which TWO controls are automatically enabled when they select the FEDRAMP_HIGH regime?

Accepted Answer

Resource location restrictions (data must remain in the US). When selecting the FEDRAMP_HIGH regime in Assured Workloads, only resource location restrictions (data must remain in the US) and compliance monitoring are automatically enforced. Google personnel access restrictions is an optional control that must be manually enabled. VPC Service Controls and Cloud Armor WAF are not automatically enforced by Assured Workloads.

Answer

Google personnel access restrictions

Answer

VPC Service Controls

Answer

Cloud Armor WAF

Question 2

A company is implementing a data retention policy to comply with regulatory requirements. They need to retain certain BigQuery data for 7 years and ensure it cannot be deleted before the retention period ends. Which TWO steps should they take? (Choose two.)

Accepted Answer

Use IAM conditions to restrict who can delete the dataset or table.. To prevent deletion of BigQuery data for 7 years, the recommended steps are to use IAM conditions to restrict delete permissions and to export data to Cloud Storage with Bucket Lock. BigQuery does not have a native deletion prevention feature; dataset retention policies only schedule automatic deletion and do not prevent deletion. Cloud KMS key destruction makes data unreadable but does not prevent deletion. Object lifecycle management would delete data, which is the opposite of retention.

Answer

Set a retention policy on the BigQuery dataset to prevent accidental deletion.

Answer

Use Cloud KMS to encrypt the data and destroy the key after 7 years.

Answer

Enable object lifecycle management to delete data after 7 years.

Question 3

A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP can inspect Cloud Storage buckets for sensitive data like PHI and redact or de-identify it automatically using its inspect and transform pipeline.

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Security Command Center

Question 4

A company needs to retain audit logs for 7 years to meet compliance requirements. By default, Cloud Audit Logs are retained for 30 days. What should they do to retain the logs for 7 years?

Accepted Answer

Create a log sink to export audit logs to a Cloud Storage bucket with a retention policy set to 7 years.. Log Sinks can route logs to Cloud Storage Buckets, which support retention policies. Object Retention Lock can enforce WORM compliance if required.

Answer

Increase the default audit log retention period in the Logging settings to 7 years.

Answer

Enable Logging export to BigQuery and set table expiration to 7 years.

Answer

Use Cloud Functions to copy audit logs daily to Coldline Storage.

Question 5

A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?

Accepted Answer

Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.. VPC Service Controls provide a perimeter that prevents data exfiltration from managed services, while GKE network policies enforce pod-level isolation. Both are recommended for PCI DSS CDE isolation.

Answer

Use Cloud Armor to inspect all traffic and block non-compliant requests.

Answer

Enable Data Loss Prevention to scan payment data and restrict access.

Answer

Deploy the CDE in a separate project and use IAM roles to restrict access.

Question 6

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

Accepted Answer

Assured Workloads. Assured Workloads includes Access Transparency and Access Approval controls to restrict Google personnel access. When creating an Assured Workload with ITAR regime, these controls are enabled by default.

Answer

IAM Conditions

Answer

VPC Service Controls

Answer

Cloud HSM

Question 7

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

Accepted Answer

Bucket locking with a retention policy. Bucket locking with a retention policy allows you to set a WORM (Write Once, Read Many) policy on a bucket, preventing object deletion or modification for a specified duration. This is the correct feature for implementing a 5-year data retention policy that prevents any modification or deletion. Object Retention Lock is an AWS S3 feature, not a GCP feature, so option D is incorrect.

Answer

Lifecycle management rules

Answer

Object versioning

Answer

Object Retention Lock

Question 8

A company processes personal data of European Union residents on GCP. They need to ensure that data processing is limited to specific purposes and that data subjects can exercise their rights (access, rectification, erasure). Which actions should they take to comply with GDPR?

Accepted Answer

Sign a DPA with Google, implement data subject request workflows, and use Cloud DLP to classify personal data.. To comply with GDPR, the company must sign a Data Processing Agreement (DPA) with Google, implement data subject rights (like deletion), and document processing purposes. Encryption is encouraged but not a specific GDPR requirement listed in the options.

Answer

Use Assured Workloads with EU Regions and Support and enable Access Transparency.

Answer

Enable data encryption with CMEK and sign a DPA with Google.

Answer

Enable VPC Service Controls and restrict data access to EU regions.

Question 9

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud does not require prior approval for penetration testing of most services, but Denial of Service (DoS) testing is explicitly prohibited.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.

Question 10

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

Accepted Answer

Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.. BigQuery audit logs are immutable and cannot be deleted individually. The recommended approach is to export logs to Cloud Storage and use log sinks to filter out or redact personal data before storage.

Answer

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Answer

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Answer

Set a table expiration on the audit logs dataset to delete all logs after a short period.

Question 11

Which Google Cloud compliance certification requires the customer to sign a Business Associate Agreement (BAA) with Google?

Accepted Answer

HIPAA. HIPAA requires a BAA between a covered entity (or business associate) and Google Cloud before processing Protected Health Information (PHI).

Answer

PCI DSS

Answer

SOC 2

Answer

FedRAMP

Question 12

A government contractor needs to deploy workloads on GCP that meet FedRAMP High baseline requirements. They want to enforce resource location restrictions and access controls for Google personnel. Which product should they use?

Accepted Answer

Assured Workloads. Assured Workloads provides compliance-focused folders that enforce location restrictions, personnel access controls, and other controls specific to the chosen regime (e.g., FedRAMP High).

Answer

Cloud Security Command Center

Answer

VPC Service Controls

Answer

Organization Policies

Question 13

Which of the following is a customer responsibility under the Google Cloud shared responsibility model?

Accepted Answer

Encryption of data at rest and in transit. The shared responsibility model assigns physical security, hardware, and hypervisor security to Google; the customer is responsible for data encryption, IAM, network controls, and application security.

Answer

Physical security of data centers

Answer

Hardware maintenance

Answer

Hypervisor security

Question 14

A company wants to enforce that all Cloud Storage buckets created in their organization have a retention policy for compliance. If a bucket is created without a retention policy, it should be automatically remediated. Which approach should they use?

Accepted Answer

Use an Organization Policy with a constraint to require a retention policy on all buckets and use Cloud Asset Inventory to enforce remediation.. Organization policies with a constraint can enforce that all buckets have a retention policy. However, if a bucket is created without one, Cloud Asset Inventory can detect the violation and trigger a Cloud Function to apply a default retention policy.

Answer

Use Cloud DLP to scan buckets and add retention policies automatically.

Answer

Use Security Command Center to find non-compliant buckets and manually apply retention policies.

Answer

Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.

Question 15

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Accepted Answer

Use Cloud External Key Manager (EKM) with a supported partner.. PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Answer

Use SHA-1 for SSL certificates.

Answer

Use default Google encryption keys (Google-managed) for data at rest.

Answer

Use TLS 1.0 for data in transit.