PCSE Ensuring Data Protection Practice Test 2 — 15 Questions

Question 1

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to rotate the key used for an existing disk without recreating the disk. What must the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detach the disk and reattach it with the new CSEK key. CSEK keys are not stored in Google Cloud; they are provided by the customer at the time of disk attachment. To rotate the key, you must detach the disk and reattach it with the new CSEK key, as the key is only used during the attach operation to encrypt the disk's data encryption keys (DEKs). The disk itself is not re-encrypted; the new key is used to wrap the DEKs for future reads/writes.

Answer

Rotate the key in Cloud KMS and the disk will automatically use it

Answer

Create a snapshot of the disk and restore it with a new CMEK key

Answer

Use gcloud compute disks update with the new key

Question 2

A company wants to use Cloud KMS to encrypt data in Cloud Storage with a key that is automatically rotated every 30 days. They also want to ensure that the key material is stored in a HSM. Which TWO resources must they create? (Choose two.)

Accepted Answer

A Cloud HSM key ring. Option A is correct because in Cloud KMS the key ring is the container that must be created first, and for HSM-backed keys it must be a Cloud HSM key ring (created in a location that supports Cloud HSM), which is the resource that hosts HSM-protected keys. Option D is correct because the actual key must be created as a cryptographic key with protection level HSM, which stores and performs cryptographic operations using key material held in a hardware security module; this key can also be configured with a 30-day rotation period to meet the automatic rotation requirement. Option B is incorrect because purpose EXTERNAL is for keys whose material is imported or externally managed and is not the way to obtain HSM-backed key material. Option C is incorrect because protection level software stores key material in software rather than an HSM, violating the HSM requirement. Option E is incorrect because a Cloud HSM cluster is an Cloud HSM (hardware security module) resource used for Cloud HSM, not a Cloud KMS resource required to create HSM-protected Cloud KMS keys.

Answer

A key with purpose EXTERNAL

Answer

A key ring with protection level software

Answer

A Cloud HSM cluster

Question 3

A security engineer wants to encrypt data at rest in Cloud Storage using a key that Google manages but the customer can control the key material. They need to rotate the key automatically every 90 days. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) via Cloud KMS. Customer-Managed Encryption Keys (CMEK) via Cloud KMS lets the customer control the key material (they own and manage the key in Cloud KMS) while Google's infrastructure performs the actual encryption/decryption of data at rest. Cloud KMS supports automatic key rotation on a configurable schedule, including every 90 days, which satisfies the rotation requirement. This is the only option that gives customer control over key material plus automated rotation.

Answer

Google default encryption (GMEK)

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Cloud HSM

Question 4

A company uses Cloud HSM to protect their cryptographic keys. They need to ensure that the key material never leaves the HSM. Which key purpose is supported by Cloud HSM keys?

Accepted Answer

All key purposes (ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, MAC). Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. HSM keys can have purposes ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, and MAC. The key material remains inside the HSM cluster and is never exposed to the customer. Software keys (software-backed) are stored in Cloud KMS but not in HSM.

Answer

Only symmetric ENCRYPT_DECRYPT

Answer

Only MAC purpose

Answer

Only asymmetric purposes

Question 5

A data engineer wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII). Which resource should they create to run this scan?

Accepted Answer

Create a DlpJob. A DlpJob is the actual resource that executes a Cloud DLP scan on a specified storage bucket or other data source. When you create a DlpJob, you specify the inspection configuration (e.g., an InspectTemplate) and the target data, and the job runs the scan to identify sensitive information. This is the direct action that performs the PII detection.

Answer

Create an InspectTemplate

Answer

Create a JobTrigger

Answer

Create a DeidentifyTemplate

Question 6

What is the default grace period before Cloud KMS permanently destroys a key version that has been scheduled for destruction?

Accepted Answer

24 hours. When a Cloud KMS key version is scheduled for destruction, it enters a 'Scheduled for destruction' state with a default 24-hour grace period before permanent destruction. During this window, the key version can still be restored to the ENABLED state, after which destruction is irreversible. The 24-hour default is configurable up to 120 days via the destroyScheduledDuration field.

Answer

7 days

Answer

Immediate destruction with no grace period

Answer

30 days

Question 7

A security engineer needs to enforce column-level masking on a BigQuery table such that: (1) users with role 'data_analyst' see masked values, (2) users with role 'data_scientist' see plaintext values, and (3) the masking is applied automatically without modifying the underlying table. Which three components must they configure? (Choose 3)

Accepted Answer

IAM roles (e.g., roles/bigquery.maskedReader). Option A (IAM roles such as roles/bigquery.maskedReader) is correct because BigQuery column-level security uses the maskedReader role to grant users access to the column while only returning the masked value, whereas roles/bigquery.dataViewer would return plaintext. Option B (BigQuery Data Policy with masking rule) is correct because a data policy defines the masking rule (e.g., SHA256, nullify, default value) that is applied to the tagged column automatically at query time without altering the stored data. Option D (Data Catalog taxonomy with policy tags) is correct because policy tags are attached to the column schema and referenced by the data policy, which is how BigQuery knows which masking rule to enforce on which column for which principals. Option C (Cloud KMS key for column encryption) is not needed because column-level masking is a query-time access control feature, not encryption at rest, and does not require a customer-managed KMS key. Option E (Cloud DLP de-identification job) is not needed because DLP is a separate service for discovering and transforming data in pipelines or exports, not the mechanism that enforces dynamic column-level masking in BigQuery.

Answer

Cloud KMS key for column encryption

Answer

Cloud DLP de-identification job

Question 8

An organization stores sensitive data in Cloud Storage and wants to use Cloud DLP to automatically scan new objects for PII as they are uploaded. Which two resources are needed? (Choose 2)

Accepted Answer

Cloud Storage Pub/Sub notifications. Option C (Cloud Storage Pub/Sub notifications) is correct because Cloud Storage can publish object change events (such as OBJECT_FINALIZE) to a Pub/Sub topic, which is the event-driven mechanism that signals when a new object is uploaded and ready to be scanned. Option D (Cloud DLP JobTrigger) is correct because a Cloud DLP JobTrigger is the resource that defines and schedules DLP scan jobs against a data source, and it can be configured to run on a trigger (for example, when a Pub/Sub notification arrives) so that new objects are automatically inspected for PII. The unmarked options do not belong: Cloud Scheduler (A) is for time-based cron scheduling, not for reacting to individual object upload events; Cloud Functions (B) is a compute service that could act as glue but is not a required resource for wiring Cloud Storage notifications to Cloud DLP; and Cloud DLP InspectTemplate (E) is a reusable configuration of what to inspect (infoTypes, likelihood, etc.), not the resource that triggers or schedules the scan.

Answer

Cloud Scheduler

Answer

Cloud Functions

Answer

Cloud DLP InspectTemplate

Question 9

A financial services company must encrypt data at rest in Cloud Storage using keys that are generated and stored on-premises, and Google must never have access to the key material. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). CSEK (Customer-Supplied Encryption Keys) allows you to provide your own keys with each API call, and Google does not store them. This meets the requirement that Google never has access to key material.

Answer

Cloud External Key Manager (EKM) with a key management partner

Answer

Default Google-managed encryption (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS

Question 10

A company is using Cloud DLP to inspect a BigQuery table containing customer PII. They want to redact all credit card numbers found in a column by replacing them with a token that preserves the format (e.g., last 4 digits visible). Which de-identification transform should they use?

Accepted Answer

MaskingConfig with a masking character. To redact credit card numbers while keeping the last 4 digits visible, use MaskingConfig with a masking character configured to mask all but the last 4 characters. CryptoReplaceFfxFpeConfig preserves format and length but encrypts the entire value, so it cannot leave the last 4 digits visible.

Answer

DateShiftConfig

Answer

BucketingConfig

Answer

CryptoReplaceFfxFpeConfig

Question 11

A security engineer notices that a Cloud KMS key was accidentally deleted. The key had a pending destruction period of 24 hours. What is the maximum time window to recover the key after the deletion request?

Accepted Answer

24 hours. When a Cloud KMS key is deleted, it enters a scheduled destruction state with a configurable pending period. The maximum configurable pending destruction period is 24 hours, after which the key is permanently destroyed and cannot be recovered. Therefore the maximum recovery window is 24 hours.

Answer

30 days

Answer

7 days

Answer

Immediately after deletion it cannot be recovered

Question 12

A healthcare organization uses Cloud DLP to scan a Cloud Storage bucket containing medical records. They want to inspect for sensitive data such as patient names and SSNs, but only on new objects added after a certain date. Which DLP configuration should they use?

Accepted Answer

Use Cloud Functions to trigger DLP inspection on new object creation events. To inspect only new objects added after a certain date, the best approach is to use Cloud Functions to trigger DLP inspection on new object creation events. This allows real-time scanning of new objects as they are uploaded, and you can filter by date if needed. The other options either scan the entire bucket or do not directly support time-based filtering in the way described.

Answer

Create a DLP job trigger with a schedule that runs daily and scans the entire bucket

Answer

Use BigQuery to query the bucket and then scan the results with DLP

Answer

Create a DLP job trigger with a schedule and set `cloud_storage_options.time_filter` to scan only objects after a date

Question 13

A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)

Accepted Answer

Ensure that the key's destruction policy does not automatically destroy versions before 6 months. Option C is correct because Cloud KMS supports automatic rotation by setting the rotation period on a symmetric encryption key (for example, 30 days via `gcloud kms keys update --rotation-period=30d`), which schedules new primary key versions automatically. Option D is correct because old key versions remain usable for decryption unless explicitly destroyed; retaining them keeps ciphertext decryptable past rotation. Option A is correct because the key's destruction policy (or absence of a scheduled destruction) must not remove versions before the 6-month retention window, otherwise old ciphertext could become undecryptable. Option B is wrong because manual rotation via a Cloud Function is unnecessary and does not provide the native automatic rotation guarantee. Option E is wrong because `next_rotation_time` only sets when the next rotation occurs; it does not by itself establish a recurring 30-day rotation period.

Answer

Manually rotate the key every 30 days using a Cloud Function

Answer

Configure the key's `next_rotation_time` to start rotation immediately

Question 14

A company wants to use Cloud DLP to de-identify sensitive data in a BigQuery table. They need to replace credit card numbers with a token that preserves the format and also mask email addresses by showing only the first character. Which TWO de-identification transforms should they use? (Choose two.)

Accepted Answer

MaskingConfig. Option B, CryptoReplaceFfxFpeConfig, is correct because FFX format-preserving encryption (FPE) replaces a value with a token of the same length and character set, which is exactly what is needed to preserve the format of credit card numbers while de-identifying them. Option A, MaskingConfig, is correct because masking lets you specify a masking character and the number of characters to retain; setting charactersToMask to show only the first character of an email address achieves the required partial masking. DateShiftConfig (C) only shifts dates by a random number of days and cannot tokenize credit cards or mask emails. ReplaceValueConfig (D) replaces values with a fixed surrogate such as '[REDACTED]', which does not preserve the credit card format. BucketingConfig (E) groups numeric or date values into ranges, which is not a tokenization or character-masking operation.

Answer

DateShiftConfig

Answer

ReplaceValueConfig

Answer

BucketingConfig

Question 15

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted using keys that they manage and rotate on a schedule they control. The keys must be stored in a FIPS 140-2 Level 3 validated HSM. Which encryption approach should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud HSM. Customer-Managed Encryption Keys (CMEK) combined with Cloud HSM allow customers to manage their own keys in a FIPS 140-2 Level 3 validated HSM. Google-managed keys do not give customer control, and Customer-Supplied Encryption Keys (CSEK) require the customer to supply the key with each API call and Google does not store the key, which is impractical for many use cases and does not use HSM.

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys (GMEK)