PCSE Ensuring Data Protection — 20 Questions

Question 1

A financial services company uses BigQuery for analytics and needs to implement column-level security such that users with the role 'data_scientist' can see the last four digits of credit card numbers, while the full number is visible only to 'data_owner'. What approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a policy tag with a data masking rule that masks the full number except last four digits, and grant UNMASKED access to data_owner and MASKED access to data_scientist.. BigQuery's policy tags with data masking rules allow you to define column-level masking policies. By creating a masking rule that reveals only the last four digits of the credit card number, you can grant the `data_scientist` role MASKED access (which applies the mask) and the `data_owner` role UNMASKED access (which bypasses the mask). This approach enforces column-level security without duplicating data or using row-level filters.

Answer

Set an IAM condition on the table that filters the column based on the user's role.

Answer

Use row-level security to restrict rows based on role.

Answer

Create two separate BigQuery tables (one with masked data, one with full data) and grant access based on role.

Question 2

A company uses Cloud DLP to de-identify a dataset containing customer phone numbers. They need to replace each phone number with a consistently masked value that preserves the format (e.g., XXX-XXX-1234) but cannot be reversed. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig is the correct choice because it irreversibly replaces characters in a string while preserving the format. In this scenario, the customer phone numbers need to be consistently masked (e.g., replacing all but the last four digits with 'X') so that the output maintains the pattern XXX-XXX-1234, and the original value cannot be recovered. MaskingConfig supports character-level replacement with a fixed character (like 'X') and can preserve the original length and formatting, which meets the requirement for a non-reversible, format-preserving de-identification.

Answer

DateShiftConfig

Answer

CryptoReplaceFfxFpeConfig

Answer

BucketingConfig

Question 3

A data scientist needs to access a secret stored in Secret Manager from a Compute Engine VM. The VM has the default service account attached. Which IAM role should be granted to the service account to allow reading the secret?

Accepted Answer

roles/secretmanager.secretAccessor. The correct role is roles/secretmanager.secretAccessor because it grants the specific permission secretmanager.versions.access required to read the secret payload from Secret Manager. The default Compute Engine service account needs only this minimal permission to retrieve the secret value, following the principle of least privilege.

Answer

roles/secretmanager.admin

Answer

roles/iam.serviceAccountUser

Answer

roles/secretmanager.viewer

Question 4

A company wants to use Cloud DLP to inspect Cloud Storage buckets for phone numbers that match a custom pattern (e.g., +1-XXX-XXX-XXXX). The pattern is not covered by built-in infoTypes. How should the engineer configure the DLP job?

Accepted Answer

Create a custom infoType with a regex pattern. Cloud DLP allows you to define custom infoTypes using regular expressions to match patterns not covered by built-in infoTypes. By creating a custom infoType with a regex pattern like `\+1-\d{3}-\d{3}-\d{4}`, the DLP job can inspect Cloud Storage buckets for phone numbers in the specified format. This approach directly addresses the requirement without relying on external services or unsupported built-in types.

Answer

Use the built-in PHONE_NUMBER infoType

Answer

Use Cloud Functions to scan the files and call DLP API

Answer

Store the pattern in Secret Manager and reference it in the DLP job

Question 5

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to rotate the key used for an existing disk without recreating the disk. What must the engineer do?

Accepted Answer

Detach the disk and reattach it with the new CSEK key. CSEK keys are not stored in Google Cloud; they are provided by the customer at the time of disk attachment. To rotate the key, you must detach the disk and reattach it with the new CSEK key, as the key is only used during the attach operation to encrypt the disk's data encryption keys (DEKs). The disk itself is not re-encrypted; the new key is used to wrap the DEKs for future reads/writes.

Answer

Rotate the key in Cloud KMS and the disk will automatically use it

Answer

Create a snapshot of the disk and restore it with a new CMEK key

Answer

Use gcloud compute disks update with the new key

Question 6

A company is designing a key destruction process for Cloud KMS. They need to ensure that after a key is destroyed, the ciphertext encrypted with that key becomes permanently undecryptable. They also need to allow a 7-day recovery window in case of accidental destruction. Which three steps should they take? (Choose THREE).

Accepted Answer

Schedule destruction of the key and set a destruction period of 7 days.. To ensure that ciphertext becomes permanently undecryptable after key destruction, the key must be destroyed without any remaining backup or ability to decrypt. Scheduling destruction with a 7-day destruction period provides the required recovery window (A). Using Cloud HSM to store key material ensures that the key material is stored in hardware security modules that enforce tamper-resistant destruction, providing additional assurance that the key is securely destroyed and cannot be recovered after the grace period (C). Before destruction, it is critical to verify that no active resources are using the key, otherwise the destruction may fail or leave resources in an inconsistent state (D). Disabling the key (B) is not necessary as scheduling destruction directly transitions the key to pending destruction state. Rotating the key (E) creates a new version but does not affect destruction of the original version.

Answer

Disable the key before scheduling destruction.

Answer

Rotate the key before destruction to create a new version.

Question 7

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM

Question 8

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They need to rotate the key automatically every 30 days. What must they configure?

Accepted Answer

Set a rotation period of 30 days on the key.. Cloud KMS allows you to set a rotation period directly on a key (a CryptoKey resource) when its purpose is ENCRYPT_DECRYPT. Configuring a rotation period of 30 days on the key enables automatic, scheduled rotation, where Cloud KMS creates a new key version every 30 days and promotes it to primary, without any manual intervention.

Answer

Use a cron job to rotate keys manually every 30 days.

Answer

Set a rotation period of 30 days on the key ring.

Answer

Set a rotation period on the key version.

Question 9

Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed information about actions taken by Google staff when accessing customer data. Access Approval is a separate feature that requires approval before access. Audit Logs is a broader category. Cloud DLP is for data loss prevention.

Answer

Access Approval

Answer

Cloud DLP

Answer

Cloud Audit Logs

Question 10

A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.. Secret Manager can set a rotation period and publish a Pub/Sub message upon rotation. A Cloud Function can subscribe to that topic and execute updates. Directly triggering from Secret Manager is not possible. Cloud Scheduler is not needed.

Answer

Manually rotate the secret and set a Cloud Scheduler job to invoke the Cloud Function.

Answer

Use Cloud Scheduler to call the Secret Manager API to add a new version every 60 days, then trigger a Cloud Function via HTTP.

Answer

Set a rotation period on the secret and directly specify a Cloud Function as a webhook in Secret Manager.

Question 11

A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?

Accepted Answer

De-identification job using a masking transform for credit card numbers.. Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.

Answer

Inspection job with a Cloud Data Loss Prevention API to call a Cloud Function.

Answer

De-identification job with a bucketing transform.

Answer

Inspection job with a Cloud Pub/Sub notification to trigger a Cloud Function that redacts the data.

Question 12

An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?

Accepted Answer

Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.. Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Answer

Assign the roles/storage.admin IAM role with a condition that restricts region.

Answer

Use Assured Workloads to enforce data residency.

Answer

Define a bucket policy that allows only europe-west1.

Question 13

A company wants to use Cloud KMS with a key that is protected by a Hardware Security Module (HSM) and meets FIPS 140-2 Level 3. Which key type should they create in Cloud KMS?

Accepted Answer

HSM key with any purpose. Cloud KMS offers HSM keys that are generated and protected within an FIPS 140-2 Level 3 certified HSM. When a company requires FIPS 140-2 Level 3 compliance, the only key type that meets this requirement is an HSM key, regardless of its purpose (e.g., symmetric encryption, asymmetric signing). Software keys, even with any purpose, only meet FIPS 140-2 Level 1.

Answer

External key stored in Cloud HSM

Answer

Software key with ASYMMETRIC_SIGN purpose

Answer

Software key with ENCRYPT_DECRYPT purpose

Question 14

What is the purpose of the Cloud DLP InfoType detector CREDIT_CARD_NUMBER?

Accepted Answer

It detects credit card numbers in data during inspection.. Cloud DLP InfoType detectors are used to identify specific types of sensitive data. CREDIT_CARD_NUMBER is a built-in detector that finds credit card numbers in text or files.

Answer

It encrypts credit card numbers automatically.

Answer

It redacts credit card numbers from images.

Answer

It de-identifies credit card numbers using masking.

Question 15

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to ensure that Google does not store the key material. What must they do?

Accepted Answer

Use the gcloud compute disks create command with the --csek-key-file flag to supply the key, and do not store the key in Cloud KMS.. Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Answer

Enable Cloud HSM to protect the key.

Answer

Set an organization policy to prevent Google from storing keys.

Answer

Create a Cloud KMS key and use it as a CSEK.

Question 16

An engineer needs to destroy a Cloud KMS key immediately due to a security incident. They disable the key and then schedule destruction. What is the default waiting period before the key is permanently destroyed?

Accepted Answer

24 hours. In Cloud KMS, when you schedule destruction of a key version, there is a default pending destruction grace period of 24 hours. During this time, you can cancel destruction. The key is not immediately destroyed.

Answer

Immediate destruction

Answer

7 days

Answer

30 days

Question 17

A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?

Accepted Answer

Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.. Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Answer

Use VPC Service Controls to prevent data exfiltration.

Answer

Set IAM conditions on all resources to allow only US regions.

Answer

Use Cloud DLP to scan and block data leaving the US.

Question 18

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Accepted Answer

Data Catalog taxonomy with policy tags. BigQuery column-level security requires a Data Catalog taxonomy with policy tags, and then BigQuery Data Policy to define masking rules (e.g., email masking). Policy tags alone provide access control but not masking; data policies provide the masking.

Answer

Cloud DLP de-identification templates

Answer

IAM roles with conditions on table

Answer

Cloud KMS key for encryption

Question 19

A company wants to implement automatic de-identification of sensitive data stored in Cloud Storage using Cloud DLP. They need to scan new objects as they are uploaded and apply a transformation to remove credit card numbers. Which three resources must they create? (Choose THREE.)

Accepted Answer

Cloud DLP job that uses the trigger and template. To automatically de-identify sensitive data in Cloud Storage using Cloud DLP, you must create three resources: a Cloud DLP job trigger (C) to initiate the scan when new objects are uploaded, a Cloud DLP de-identification template (E) that specifies the transformation (e.g., removing credit card numbers), and a Cloud DLP job (B) that references both the trigger and the de-identification template. The inspection template (A) is not required because the job can directly specify the infoTypes to inspect in its configuration.

Answer

Cloud DLP inspection template

Answer

Cloud Function to process objects

Question 20

Which two statements correctly describe Cloud KMS key versions? (Choose TWO.)

Accepted Answer

Key versions are immutable once created.. Key versions in Cloud KMS are immutable and each has its own key material. You can enable or disable versions for rotation. A key has multiple versions; rotation creates new versions. The state can be ENABLED, DISABLED, DESTROYED, etc. The grace period applies to destruction scheduling.

Answer

Key versions can be rotated automatically without creating a new version.

Answer

The destruction of a key version is immediate upon request.

Answer

Each key version can have a different purpose.