PCSE Ensuring Data Protection — 40 Questions

Question 1

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM

Question 2

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They need to rotate the key automatically every 30 days. What must they configure?

Accepted Answer

Set a rotation period of 30 days on the key.. Option A is correct because Cloud KMS allows you to set a rotation period directly on a key (a CryptoKey resource) when its purpose is ENCRYPT_DECRYPT. Configuring a rotation period of 30 days on the key enables automatic, scheduled rotation, where Cloud KMS creates a new key version every 30 days and promotes it to primary, without any manual intervention.

Answer

Use a cron job to rotate keys manually every 30 days.

Answer

Set a rotation period of 30 days on the key ring.

Answer

Set a rotation period on the key version.

Question 3

Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed information about actions taken by Google staff when accessing customer data. Access Approval is a separate feature that requires approval before access. Audit Logs is a broader category. Cloud DLP is for data loss prevention.

Answer

Access Approval

Answer

Cloud DLP

Answer

Cloud Audit Logs

Question 4

A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.. Secret Manager can set a rotation period and publish a Pub/Sub message upon rotation. A Cloud Function can subscribe to that topic and execute updates. Directly triggering from Secret Manager is not possible. Cloud Scheduler is not needed.

Answer

Manually rotate the secret and set a Cloud Scheduler job to invoke the Cloud Function.

Answer

Use Cloud Scheduler to call the Secret Manager API to add a new version every 60 days, then trigger a Cloud Function via HTTP.

Answer

Set a rotation period on the secret and directly specify a Cloud Function as a webhook in Secret Manager.

Question 5

A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?

Accepted Answer

De-identification job using a masking transform for credit card numbers.. Option D is correct because Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.

Answer

Inspection job with a Cloud Data Loss Prevention API to call a Cloud Function.

Answer

De-identification job with a bucketing transform.

Answer

Inspection job with a Cloud Pub/Sub notification to trigger a Cloud Function that redacts the data.

Question 6

An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?

Accepted Answer

Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.. Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Answer

Assign the roles/storage.admin IAM role with a condition that restricts region.

Answer

Use Assured Workloads to enforce data residency.

Answer

Define a bucket policy that allows only europe-west1.

Question 7

A financial services company uses BigQuery for analytics and needs to implement column-level security such that users with the role 'data_scientist' can see the last four digits of credit card numbers, while the full number is visible only to 'data_owner'. What approach should they use?

Accepted Answer

Use a policy tag with a data masking rule that masks the full number except last four digits, and grant UNMASKED access to data_owner and MASKED access to data_scientist.. Option A is correct because BigQuery's policy tags with data masking rules allow you to define column-level masking policies. By creating a masking rule that reveals only the last four digits of the credit card number, you can grant the `data_scientist` role MASKED access (which applies the mask) and the `data_owner` role UNMASKED access (which bypasses the mask). This approach enforces column-level security without duplicating data or using row-level filters.

Answer

Set an IAM condition on the table that filters the column based on the user's role.

Answer

Use row-level security to restrict rows based on role.

Answer

Create two separate BigQuery tables (one with masked data, one with full data) and grant access based on role.

Question 8

A company wants to use Cloud KMS with a key that is protected by a Hardware Security Module (HSM) and meets FIPS 140-2 Level 3. Which key type should they create in Cloud KMS?

Accepted Answer

HSM key with any purpose. Cloud KMS offers HSM keys that are generated and protected within an FIPS 140-2 Level 3 certified HSM. When a company requires FIPS 140-2 Level 3 compliance, the only key type that meets this requirement is an HSM key, regardless of its purpose (e.g., symmetric encryption, asymmetric signing). Software keys, even with any purpose, only meet FIPS 140-2 Level 1.

Answer

External key stored in Cloud HSM

Answer

Software key with ASYMMETRIC_SIGN purpose

Answer

Software key with ENCRYPT_DECRYPT purpose

Question 9

What is the purpose of the Cloud DLP InfoType detector CREDIT_CARD_NUMBER?

Accepted Answer

It detects credit card numbers in data during inspection.. Cloud DLP InfoType detectors are used to identify specific types of sensitive data. CREDIT_CARD_NUMBER is a built-in detector that finds credit card numbers in text or files.

Answer

It encrypts credit card numbers automatically.

Answer

It redacts credit card numbers from images.

Answer

It de-identifies credit card numbers using masking.

Question 10

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to ensure that Google does not store the key material. What must they do?

Accepted Answer

Use the gcloud compute disks create command with the --csek-key-file flag to supply the key, and do not store the key in Cloud KMS.. Option A is correct because Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Answer

Enable Cloud HSM to protect the key.

Answer

Set an organization policy to prevent Google from storing keys.

Answer

Create a Cloud KMS key and use it as a CSEK.

Question 11

An engineer needs to destroy a Cloud KMS key immediately due to a security incident. They disable the key and then schedule destruction. What is the default waiting period before the key is permanently destroyed?

Accepted Answer

24 hours. In Cloud KMS, when you schedule destruction of a key version, there is a default pending destruction grace period of 24 hours. During this time, you can cancel destruction. The key is not immediately destroyed.

Answer

Immediate destruction

Answer

7 days

Answer

30 days

Question 12

A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?

Accepted Answer

Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.. Option C is correct because Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Answer

Use VPC Service Controls to prevent data exfiltration.

Answer

Set IAM conditions on all resources to allow only US regions.

Answer

Use Cloud DLP to scan and block data leaving the US.

Question 13

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Accepted Answer

Data Catalog taxonomy with policy tags. BigQuery column-level security requires a Data Catalog taxonomy with policy tags, and then BigQuery Data Policy to define masking rules (e.g., email masking). Policy tags alone provide access control but not masking; data policies provide the masking.

Answer

Cloud DLP de-identification templates

Answer

IAM roles with conditions on table

Answer

Cloud KMS key for encryption

Question 14

A company wants to implement automatic de-identification of sensitive data stored in Cloud Storage using Cloud DLP. They need to scan new objects as they are uploaded and apply a transformation to remove credit card numbers. Which three resources must they create? (Choose THREE.)

Accepted Answer

Cloud DLP job that uses the trigger and template. Option B is correct because a Cloud DLP job is required to orchestrate the scanning and transformation of data. It must reference both a job trigger (to start the job when new objects are uploaded) and an inspection template (to define what to look for, such as credit card numbers). Without the job, the trigger and templates cannot execute the de-identification workflow.

Answer

Cloud DLP inspection template

Answer

Cloud Function to process objects

Question 15

Which two statements correctly describe Cloud KMS key versions? (Choose TWO.)

Accepted Answer

Key versions are immutable once created.. Key versions in Cloud KMS are immutable and each has its own key material. You can enable or disable versions for rotation. A key has multiple versions; rotation creates new versions. The state can be ENABLED, DISABLED, DESTROYED, etc. The grace period applies to destruction scheduling.

Answer

Key versions can be rotated automatically without creating a new version.

Answer

The destruction of a key version is immediate upon request.

Answer

Each key version can have a different purpose.

Question 16

An organization wants to encrypt data at rest using customer-managed keys on Compute Engine persistent disks. They need to provide the key material with each API call, and Google should never store the key. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own encryption keys, which are used to encrypt data at rest. The keys are provided with each API call and are not stored by Google. CMEK uses Cloud KMS where Google stores the key material (encrypted by HSM). GMEK is Google-managed. Cloud HSM is a service for managing keys but still stores them.

Answer

Cloud HSM

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK)

Question 17

A security engineer wants to automatically rotate a database password stored in Secret Manager every 30 days. The new password should be generated and stored in Secret Manager without manual intervention. Which approach meets these requirements?

Accepted Answer

Configure a rotation period in Secret Manager, set a Pub/Sub topic, and implement a Cloud Function that listens for rotation messages to generate and add a new secret version.. Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Answer

Set up a Cloud Lifecycle rule to delete the old secret version and create a new one with the same value.

Answer

Use a Cloud KMS key to re-encrypt the secret each month.

Answer

Use gcloud secrets versions add with a scheduled Cloud Scheduler job that generates a new password and adds it as a new version.

Question 18

A healthcare company stores patient data in BigQuery and needs to mask sensitive columns like SSN and email for analysts who do not need to see the actual values. They want to apply consistent masking across queries without modifying the underlying data. Which feature should they use?

Accepted Answer

BigQuery Data Policy with data masking rules. BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Answer

IAM conditions on tables

Answer

Authorized views with row-level security

Answer

Cloud DLP de-identification transforms on export

Question 19

A company uses Cloud KMS with an HSM key for encryption of sensitive data. The compliance team requires that the key material never leaves the HSM boundary. They plan to use the key for symmetric encryption/decryption. Which key purpose should they specify when creating the key?

Accepted Answer

ENCRYPT_DECRYPT. For symmetric encryption/decryption, the key purpose must be ENCRYPT_DECRYPT. ASYMMETRIC_SIGN and ASYMMETRIC_DECRYPT are for asymmetric keys. MAC is for message authentication codes. Only ENCRYPT_DECRYPT supports symmetric operations.

Answer

ASYMMETRIC_SIGN

Answer

ASYMMETRIC_DECRYPT

Answer

MAC

Question 20

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) such as credit card numbers and social security numbers. The scanning must be performed on a schedule (every week). Which GCP service and resource should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) with a DLP job trigger. Cloud DLP can inspect data for sensitive info types. DLP job triggers allow scheduling recurring scans of Cloud Storage, BigQuery, or Datastore. The trigger runs the inspection job based on a schedule.

Answer

Cloud Security Command Center (SCC)

Answer

Cloud Asset Inventory

Answer

Cloud Audit Logs