PCSE Ensuring Data Protection — 15 Questions

Question 1

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM

Question 2

A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?

Accepted Answer

De-identification job using a masking transform for credit card numbers.. Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.

Answer

Inspection job with a Cloud Data Loss Prevention API to call a Cloud Function.

Answer

De-identification job with a bucketing transform.

Answer

Inspection job with a Cloud Pub/Sub notification to trigger a Cloud Function that redacts the data.

Question 3

A company wants to use Cloud KMS with a key that is protected by a Hardware Security Module (HSM) and meets FIPS 140-2 Level 3. Which key type should they create in Cloud KMS?

Accepted Answer

HSM key with any purpose. Cloud KMS offers HSM keys that are generated and protected within an FIPS 140-2 Level 3 certified HSM. When a company requires FIPS 140-2 Level 3 compliance, the only key type that meets this requirement is an HSM key, regardless of its purpose (e.g., symmetric encryption, asymmetric signing). Software keys, even with any purpose, only meet FIPS 140-2 Level 1.

Answer

External key stored in Cloud HSM

Answer

Software key with ASYMMETRIC_SIGN purpose

Answer

Software key with ENCRYPT_DECRYPT purpose

Question 4

An engineer needs to destroy a Cloud KMS key immediately due to a security incident. They disable the key and then schedule destruction. What is the default waiting period before the key is permanently destroyed?

Accepted Answer

24 hours. When you schedule a Cloud KMS key for destruction, the default waiting period is 24 hours. This allows time to cancel the destruction if it was done accidentally. The key is not destroyed immediately; it enters a 'scheduled for destruction' state and can be restored during this period.

Answer

Immediate destruction

Answer

7 days

Answer

30 days

Question 5

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Accepted Answer

Data Catalog taxonomy with policy tags. Option A is correct because a Data Catalog taxonomy with policy tags provides the classification mechanism that labels specific BigQuery columns as sensitive, which is the prerequisite for column-level access control. Option B is correct because BigQuery Data Policies with masking rules (for example, a data policy that applies a SHA-256 or null masking rule) enforce the actual masking on those policy-tagged columns, so analysts see masked values while data stewards, granted the fine-grained reader role, see full data. Together, the taxonomy/policy tags define what is sensitive and the data policy defines how it is masked, which is exactly the combination required for column-level dynamic masking in BigQuery. Option C is not required because Cloud DLP de-identification templates are used for inspection and transformation pipelines, not for enforcing column-level masking at query time. Option D is not sufficient because IAM conditions on a table cannot mask individual column values for different users. Option E is not relevant because Cloud KMS handles encryption at rest, not dynamic data masking for analysts versus stewards.

Answer

Cloud DLP de-identification templates

Answer

IAM roles with conditions on table

Answer

Cloud KMS key for encryption

Question 6

A company wants to implement automatic de-identification of sensitive data stored in Cloud Storage using Cloud DLP. They need to scan new objects as they are uploaded and apply a transformation to remove credit card numbers. Which three resources must they create? (Choose THREE.)

Accepted Answer

Cloud DLP job that uses the trigger and template. Option B is correct because a Cloud DLP job is the resource that actually executes the scan-and-transform operation, and it must reference both the trigger (to know when to run) and the templates (to know what to inspect and how to transform). Option C is correct because a Cloud DLP job trigger is required to make the job run automatically when new objects are uploaded to Cloud Storage, rather than running on demand. Option E is correct because a de-identification template defines the transformation (for example, replacing or masking credit card numbers via infoType CREDIT_CARD_NUMBER) that the job applies to the sensitive data. Option A is not needed because inspection configuration can be embedded in the de-identification template or job itself, so a separate inspection template is not strictly required for this scenario. Option D is not needed because Cloud DLP's native Cloud Storage integration with job triggers handles the scanning and transformation without a custom Cloud Function.

Answer

Cloud DLP inspection template

Answer

Cloud Function to process objects

Question 7

A security administrator wants to receive near-real-time logs whenever a Google Cloud support engineer accesses their customer content. Which GCP service provides this capability?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of actions taken by Google personnel when accessing customer content. It is part of the Assured Workloads offering and can be enabled for supported services.

Answer

Cloud Audit Logs (Admin Activity)

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs (Data Access)

Question 8

A company uses Cloud DLP to de-identify a dataset containing customer phone numbers. They need to replace each phone number with a consistently masked value that preserves the format (e.g., XXX-XXX-1234) but cannot be reversed. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig is the correct choice because it irreversibly replaces characters in a string while preserving the format. In this scenario, the customer phone numbers need to be consistently masked (e.g., replacing all but the last four digits with 'X') so that the output maintains the pattern XXX-XXX-1234, and the original value cannot be recovered. MaskingConfig supports character-level replacement with a fixed character (like 'X') and can preserve the original length and formatting, which meets the requirement for a non-reversible, format-preserving de-identification.

Answer

DateShiftConfig

Answer

CryptoReplaceFfxFpeConfig

Answer

BucketingConfig

Question 9

A security engineer accidentally deleted a Cloud KMS key version. The key version is in the state DESTROY_SCHEDULED. How long does the engineer have to cancel the destruction before the key material is permanently destroyed?

Accepted Answer

24 hours. When a key version is scheduled for destruction, it enters a pending destruction grace period. The default grace period is 24 hours, during which the destruction can be canceled. After that, the key material is destroyed and unrecoverable.

Answer

30 days

Answer

Immediate destruction, no grace period

Answer

7 days

Question 10

A company needs to enforce that all data stored in Cloud Storage and BigQuery is encrypted with customer-managed keys (CMEK). Which TWO actions should they take? (Choose two.)

Accepted Answer

Set the organization policy constraint 'constraints/gcp.cmeKRequired' for Cloud Storage and BigQuery.. Option C is correct because the organization policy constraint 'constraints/gcp.cmeKRequired' (CMEK Required) enforces at the organization, folder, or project level that Cloud Storage buckets and BigQuery datasets must be encrypted with customer-managed encryption keys, preventing creation of resources without CMEK. Option E is correct because CMEK requires a Cloud KMS key ring and a symmetric encryption key (e.g., a Cloud KMS AES-256 key) that Cloud Storage and BigQuery use to wrap the data encryption keys; without a KMS key there is nothing to reference as the CMEK. Option A is not correct because Access Transparency logs record Google personnel access to customer data and do not enforce CMEK. Option B is not correct because Cloud HSM keys are a compliance choice for FIPS 140-2 Level 3, not a requirement for enforcing CMEK, and software KMS keys also satisfy CMEK. Option D is not correct because Cloud DLP discovers and classifies sensitive data and does not enforce encryption with customer-managed keys.

Answer

Enable Access Transparency logs.

Answer

Create a Cloud HSM key to ensure FIPS 140-2 Level 3 compliance.

Answer

Use Cloud DLP to inspect and classify data.

Question 11

A company needs to meet the EU data boundary requirements for Assured Workloads, ensuring that data processing and storage remain within the European Union. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create an Assured Workloads folder with a location of 'eu'.. Option B is correct because an Assured Workloads folder must be created with the EU location (e.g., 'europe-west' or the EU data boundary setting) so that the compliance controls, including data residency, are enforced at the folder level for all contained projects. Option E is correct because the organization policy constraint 'gcp.resourceLocations' must be set to allow only EU regions, which prevents resources from being deployed outside the European Union and is a required guardrail for EU data boundary compliance. Option A is incorrect because log sinks in the US would violate the EU data boundary by storing or processing logs outside the EU. Option C is incorrect because Access Approval is an optional additional control for sensitive operations and is not required to meet EU data boundary requirements. Option D is incorrect because a CMEK key ring in a non-EU region would place key material outside the EU, contradicting the data residency requirement.

Answer

Enable Cloud Logging with log sinks in the US.

Answer

Enable Access Approval for all projects.

Answer

Use a CMEK key from a key ring in a non-EU region.

Question 12

A company uses Cloud DLP to scan a BigQuery table containing customer data. They want to de-identify credit card numbers so that the first 12 digits are masked with 'X' and the last 4 digits remain visible. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig with a masking character 'X' and a character mask range from -12 to -1 (or similar) can achieve this. However, for consistent de-identification of credit card numbers, the CryptoReplaceFfxFpeConfig with an appropriate range might be used, but it preserves format. The direct mask is MaskingConfig. The correct answer is MaskingConfig as it allows masking specific character ranges. The other options: DateShiftConfig shifts dates, BucketingConfig groups values, and CryptoReplaceFfxFpeConfig preserves format but does not mask.

Answer

DateShiftConfig

Answer

BucketingConfig

Answer

CryptoReplaceFfxFpeConfig

Question 13

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Catalog and BigQuery Data Policy. BigQuery column-level security uses policy tags attached to columns, which are defined in Data Catalog taxonomies. To apply masking, you need to use BigQuery Data Policy (also known as data masking) which uses policy tags to define masking rules. Data Catalog provides the taxonomy for policy tags, while BigQuery Data Policy applies the actual masking. IAM roles for masking are granted via the policy tags.

Answer

Cloud IAM and VPC Service Controls

Answer

Secret Manager and Cloud Functions

Answer

Cloud DLP and Cloud KMS

Question 14

A company needs to store sensitive API keys in Secret Manager and ensure that only a specific service account can access the latest version of a secret. Which IAM permission is required for the service account to read the secret value?

Accepted Answer

secretmanager.versions.access. To access a secret version's payload (the actual secret value), the permission 'secretmanager.versions.access' is required. The role 'roles/secretmanager.secretAccessor' includes this permission. The other permissions are for listing or managing metadata.

Answer

secretmanager.secrets.get

Answer

secretmanager.secrets.create

Answer

secretmanager.versions.list

Question 15

A company wants to enforce that all BigQuery datasets are created in the 'US' multi-region to comply with data residency policies. Which organization policy constraint can achieve this?

Accepted Answer

gcp.resourceLocations. The 'gcp.resourceLocations' constraint restricts the locations where resources can be created. By setting the allowed locations to 'us' (or specific US regions), BigQuery datasets must be created in those locations. The other constraints: 'constraints/bigquery.restrictDatasetLocation' is not a valid organization policy. 'constraints/gcp.restrictNoncompliantResources' is not specific to locations. 'constraints/compute.trustedImageProjects' is for images.

Answer

constraints/gcp.restrictNoncompliantResources

Answer

constraints/compute.trustedImageProjects

Answer

constraints/bigquery.restrictDatasetLocation