PCSE Ensuring Data Protection — 100 Questions

Question 1

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM

Question 2

A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?

Accepted Answer

De-identification job using a masking transform for credit card numbers.. Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.

Answer

Inspection job with a Cloud Data Loss Prevention API to call a Cloud Function.

Answer

De-identification job with a bucketing transform.

Answer

Inspection job with a Cloud Pub/Sub notification to trigger a Cloud Function that redacts the data.

Question 3

A company wants to use Cloud KMS with a key that is protected by a Hardware Security Module (HSM) and meets FIPS 140-2 Level 3. Which key type should they create in Cloud KMS?

Accepted Answer

HSM key with any purpose. Cloud KMS offers HSM keys that are generated and protected within an FIPS 140-2 Level 3 certified HSM. When a company requires FIPS 140-2 Level 3 compliance, the only key type that meets this requirement is an HSM key, regardless of its purpose (e.g., symmetric encryption, asymmetric signing). Software keys, even with any purpose, only meet FIPS 140-2 Level 1.

Answer

External key stored in Cloud HSM

Answer

Software key with ASYMMETRIC_SIGN purpose

Answer

Software key with ENCRYPT_DECRYPT purpose

Question 4

An engineer needs to destroy a Cloud KMS key immediately due to a security incident. They disable the key and then schedule destruction. What is the default waiting period before the key is permanently destroyed?

Accepted Answer

24 hours. When you schedule a Cloud KMS key for destruction, the default waiting period is 24 hours. This allows time to cancel the destruction if it was done accidentally. The key is not destroyed immediately; it enters a 'scheduled for destruction' state and can be restored during this period.

Answer

Immediate destruction

Answer

7 days

Answer

30 days

Question 5

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Accepted Answer

Data Catalog taxonomy with policy tags. Option A is correct because a Data Catalog taxonomy with policy tags provides the classification mechanism that labels specific BigQuery columns as sensitive, which is the prerequisite for column-level access control. Option B is correct because BigQuery Data Policies with masking rules (for example, a data policy that applies a SHA-256 or null masking rule) enforce the actual masking on those policy-tagged columns, so analysts see masked values while data stewards, granted the fine-grained reader role, see full data. Together, the taxonomy/policy tags define what is sensitive and the data policy defines how it is masked, which is exactly the combination required for column-level dynamic masking in BigQuery. Option C is not required because Cloud DLP de-identification templates are used for inspection and transformation pipelines, not for enforcing column-level masking at query time. Option D is not sufficient because IAM conditions on a table cannot mask individual column values for different users. Option E is not relevant because Cloud KMS handles encryption at rest, not dynamic data masking for analysts versus stewards.

Answer

Cloud DLP de-identification templates

Answer

IAM roles with conditions on table

Answer

Cloud KMS key for encryption

Question 6

A company wants to implement automatic de-identification of sensitive data stored in Cloud Storage using Cloud DLP. They need to scan new objects as they are uploaded and apply a transformation to remove credit card numbers. Which three resources must they create? (Choose THREE.)

Accepted Answer

Cloud DLP job that uses the trigger and template. Option B is correct because a Cloud DLP job is the resource that actually executes the scan-and-transform operation, and it must reference both the trigger (to know when to run) and the templates (to know what to inspect and how to transform). Option C is correct because a Cloud DLP job trigger is required to make the job run automatically when new objects are uploaded to Cloud Storage, rather than running on demand. Option E is correct because a de-identification template defines the transformation (for example, replacing or masking credit card numbers via infoType CREDIT_CARD_NUMBER) that the job applies to the sensitive data. Option A is not needed because inspection configuration can be embedded in the de-identification template or job itself, so a separate inspection template is not strictly required for this scenario. Option D is not needed because Cloud DLP's native Cloud Storage integration with job triggers handles the scanning and transformation without a custom Cloud Function.

Answer

Cloud DLP inspection template

Answer

Cloud Function to process objects

Question 7

A security administrator wants to receive near-real-time logs whenever a Google Cloud support engineer accesses their customer content. Which GCP service provides this capability?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of actions taken by Google personnel when accessing customer content. It is part of the Assured Workloads offering and can be enabled for supported services.

Answer

Cloud Audit Logs (Admin Activity)

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs (Data Access)

Question 8

A company uses Cloud DLP to de-identify a dataset containing customer phone numbers. They need to replace each phone number with a consistently masked value that preserves the format (e.g., XXX-XXX-1234) but cannot be reversed. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig is the correct choice because it irreversibly replaces characters in a string while preserving the format. In this scenario, the customer phone numbers need to be consistently masked (e.g., replacing all but the last four digits with 'X') so that the output maintains the pattern XXX-XXX-1234, and the original value cannot be recovered. MaskingConfig supports character-level replacement with a fixed character (like 'X') and can preserve the original length and formatting, which meets the requirement for a non-reversible, format-preserving de-identification.

Answer

DateShiftConfig

Answer

CryptoReplaceFfxFpeConfig

Answer

BucketingConfig

Question 9

A security engineer accidentally deleted a Cloud KMS key version. The key version is in the state DESTROY_SCHEDULED. How long does the engineer have to cancel the destruction before the key material is permanently destroyed?

Accepted Answer

24 hours. When a key version is scheduled for destruction, it enters a pending destruction grace period. The default grace period is 24 hours, during which the destruction can be canceled. After that, the key material is destroyed and unrecoverable.

Answer

30 days

Answer

Immediate destruction, no grace period

Answer

7 days

Question 10

A company needs to enforce that all data stored in Cloud Storage and BigQuery is encrypted with customer-managed keys (CMEK). Which TWO actions should they take? (Choose two.)

Accepted Answer

Set the organization policy constraint 'constraints/gcp.cmeKRequired' for Cloud Storage and BigQuery.. Option C is correct because the organization policy constraint 'constraints/gcp.cmeKRequired' (CMEK Required) enforces at the organization, folder, or project level that Cloud Storage buckets and BigQuery datasets must be encrypted with customer-managed encryption keys, preventing creation of resources without CMEK. Option E is correct because CMEK requires a Cloud KMS key ring and a symmetric encryption key (e.g., a Cloud KMS AES-256 key) that Cloud Storage and BigQuery use to wrap the data encryption keys; without a KMS key there is nothing to reference as the CMEK. Option A is not correct because Access Transparency logs record Google personnel access to customer data and do not enforce CMEK. Option B is not correct because Cloud HSM keys are a compliance choice for FIPS 140-2 Level 3, not a requirement for enforcing CMEK, and software KMS keys also satisfy CMEK. Option D is not correct because Cloud DLP discovers and classifies sensitive data and does not enforce encryption with customer-managed keys.

Answer

Enable Access Transparency logs.

Answer

Create a Cloud HSM key to ensure FIPS 140-2 Level 3 compliance.

Answer

Use Cloud DLP to inspect and classify data.

Question 11

A company needs to meet the EU data boundary requirements for Assured Workloads, ensuring that data processing and storage remain within the European Union. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create an Assured Workloads folder with a location of 'eu'.. Option B is correct because an Assured Workloads folder must be created with the EU location (e.g., 'europe-west' or the EU data boundary setting) so that the compliance controls, including data residency, are enforced at the folder level for all contained projects. Option E is correct because the organization policy constraint 'gcp.resourceLocations' must be set to allow only EU regions, which prevents resources from being deployed outside the European Union and is a required guardrail for EU data boundary compliance. Option A is incorrect because log sinks in the US would violate the EU data boundary by storing or processing logs outside the EU. Option C is incorrect because Access Approval is an optional additional control for sensitive operations and is not required to meet EU data boundary requirements. Option D is incorrect because a CMEK key ring in a non-EU region would place key material outside the EU, contradicting the data residency requirement.

Answer

Enable Cloud Logging with log sinks in the US.

Answer

Enable Access Approval for all projects.

Answer

Use a CMEK key from a key ring in a non-EU region.

Question 12

A company uses Cloud DLP to scan a BigQuery table containing customer data. They want to de-identify credit card numbers so that the first 12 digits are masked with 'X' and the last 4 digits remain visible. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig with a masking character 'X' and a character mask range from -12 to -1 (or similar) can achieve this. However, for consistent de-identification of credit card numbers, the CryptoReplaceFfxFpeConfig with an appropriate range might be used, but it preserves format. The direct mask is MaskingConfig. The correct answer is MaskingConfig as it allows masking specific character ranges. The other options: DateShiftConfig shifts dates, BucketingConfig groups values, and CryptoReplaceFfxFpeConfig preserves format but does not mask.

Answer

DateShiftConfig

Answer

BucketingConfig

Answer

CryptoReplaceFfxFpeConfig

Question 13

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Catalog and BigQuery Data Policy. BigQuery column-level security uses policy tags attached to columns, which are defined in Data Catalog taxonomies. To apply masking, you need to use BigQuery Data Policy (also known as data masking) which uses policy tags to define masking rules. Data Catalog provides the taxonomy for policy tags, while BigQuery Data Policy applies the actual masking. IAM roles for masking are granted via the policy tags.

Answer

Cloud IAM and VPC Service Controls

Answer

Secret Manager and Cloud Functions

Answer

Cloud DLP and Cloud KMS

Question 14

A company needs to store sensitive API keys in Secret Manager and ensure that only a specific service account can access the latest version of a secret. Which IAM permission is required for the service account to read the secret value?

Accepted Answer

secretmanager.versions.access. To access a secret version's payload (the actual secret value), the permission 'secretmanager.versions.access' is required. The role 'roles/secretmanager.secretAccessor' includes this permission. The other permissions are for listing or managing metadata.

Answer

secretmanager.secrets.get

Answer

secretmanager.secrets.create

Answer

secretmanager.versions.list

Question 15

A company wants to enforce that all BigQuery datasets are created in the 'US' multi-region to comply with data residency policies. Which organization policy constraint can achieve this?

Accepted Answer

gcp.resourceLocations. The 'gcp.resourceLocations' constraint restricts the locations where resources can be created. By setting the allowed locations to 'us' (or specific US regions), BigQuery datasets must be created in those locations. The other constraints: 'constraints/bigquery.restrictDatasetLocation' is not a valid organization policy. 'constraints/gcp.restrictNoncompliantResources' is not specific to locations. 'constraints/compute.trustedImageProjects' is for images.

Answer

constraints/gcp.restrictNoncompliantResources

Answer

constraints/compute.trustedImageProjects

Answer

constraints/bigquery.restrictDatasetLocation

Question 16

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to rotate the key used for an existing disk without recreating the disk. What must the engineer do?

Accepted Answer

Detach the disk and reattach it with the new CSEK key. CSEK keys are not stored in Google Cloud; they are provided by the customer at the time of disk attachment. To rotate the key, you must detach the disk and reattach it with the new CSEK key, as the key is only used during the attach operation to encrypt the disk's data encryption keys (DEKs). The disk itself is not re-encrypted; the new key is used to wrap the DEKs for future reads/writes.

Answer

Rotate the key in Cloud KMS and the disk will automatically use it

Answer

Create a snapshot of the disk and restore it with a new CMEK key

Answer

Use gcloud compute disks update with the new key

Question 17

A company wants to use Cloud KMS to encrypt data in Cloud Storage with a key that is automatically rotated every 30 days. They also want to ensure that the key material is stored in a HSM. Which TWO resources must they create? (Choose two.)

Accepted Answer

A Cloud HSM key ring. Option A is correct because in Cloud KMS the key ring is the container that must be created first, and for HSM-backed keys it must be a Cloud HSM key ring (created in a location that supports Cloud HSM), which is the resource that hosts HSM-protected keys. Option D is correct because the actual key must be created as a cryptographic key with protection level HSM, which stores and performs cryptographic operations using key material held in a hardware security module; this key can also be configured with a 30-day rotation period to meet the automatic rotation requirement. Option B is incorrect because purpose EXTERNAL is for keys whose material is imported or externally managed and is not the way to obtain HSM-backed key material. Option C is incorrect because protection level software stores key material in software rather than an HSM, violating the HSM requirement. Option E is incorrect because a Cloud HSM cluster is an Cloud HSM (hardware security module) resource used for Cloud HSM, not a Cloud KMS resource required to create HSM-protected Cloud KMS keys.

Answer

A key with purpose EXTERNAL

Answer

A key ring with protection level software

Answer

A Cloud HSM cluster

Question 18

A security engineer wants to encrypt data at rest in Cloud Storage using a key that Google manages but the customer can control the key material. They need to rotate the key automatically every 90 days. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) via Cloud KMS. Customer-Managed Encryption Keys (CMEK) via Cloud KMS lets the customer control the key material (they own and manage the key in Cloud KMS) while Google's infrastructure performs the actual encryption/decryption of data at rest. Cloud KMS supports automatic key rotation on a configurable schedule, including every 90 days, which satisfies the rotation requirement. This is the only option that gives customer control over key material plus automated rotation.

Answer

Google default encryption (GMEK)

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Cloud HSM

Question 19

A company uses Cloud HSM to protect their cryptographic keys. They need to ensure that the key material never leaves the HSM. Which key purpose is supported by Cloud HSM keys?

Accepted Answer

All key purposes (ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, MAC). Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. HSM keys can have purposes ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, and MAC. The key material remains inside the HSM cluster and is never exposed to the customer. Software keys (software-backed) are stored in Cloud KMS but not in HSM.

Answer

Only symmetric ENCRYPT_DECRYPT

Answer

Only MAC purpose

Answer

Only asymmetric purposes

Question 20

A data engineer wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII). Which resource should they create to run this scan?

Accepted Answer

Create a DlpJob. A DlpJob is the actual resource that executes a Cloud DLP scan on a specified storage bucket or other data source. When you create a DlpJob, you specify the inspection configuration (e.g., an InspectTemplate) and the target data, and the job runs the scan to identify sensitive information. This is the direct action that performs the PII detection.

Answer

Create an InspectTemplate

Answer

Create a JobTrigger

Answer

Create a DeidentifyTemplate