PCSE Ensuring Data Protection Practice Test 2 — 15 Questions

Question 1

An organization wants to encrypt data at rest using customer-managed keys on Compute Engine persistent disks. They need to provide the key material with each API call, and Google should never store the key. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own encryption keys, which are used to encrypt data at rest. The keys are provided with each API call and are not stored by Google. CMEK uses Cloud KMS where Google stores the key material (encrypted by HSM). GMEK is Google-managed. Cloud HSM is a service for managing keys but still stores them.

Answer

Cloud HSM

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK)

Question 2

A security engineer wants to automatically rotate a database password stored in Secret Manager every 30 days. The new password should be generated and stored in Secret Manager without manual intervention. Which approach meets these requirements?

Accepted Answer

Configure a rotation period in Secret Manager, set a Pub/Sub topic, and implement a Cloud Function that listens for rotation messages to generate and add a new secret version.. Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Answer

Set up a Cloud Lifecycle rule to delete the old secret version and create a new one with the same value.

Answer

Use a Cloud KMS key to re-encrypt the secret each month.

Answer

Use gcloud secrets versions add with a scheduled Cloud Scheduler job that generates a new password and adds it as a new version.

Question 3

A healthcare company stores patient data in BigQuery and needs to mask sensitive columns like SSN and email for analysts who do not need to see the actual values. They want to apply consistent masking across queries without modifying the underlying data. Which feature should they use?

Accepted Answer

BigQuery Data Policy with data masking rules. BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Answer

IAM conditions on tables

Answer

Authorized views with row-level security

Answer

Cloud DLP de-identification transforms on export

Question 4

A company uses Cloud KMS with an HSM key for encryption of sensitive data. The compliance team requires that the key material never leaves the HSM boundary. They plan to use the key for symmetric encryption/decryption. Which key purpose should they specify when creating the key?

Accepted Answer

ENCRYPT_DECRYPT. For symmetric encryption/decryption, the key purpose must be ENCRYPT_DECRYPT. ASYMMETRIC_SIGN and ASYMMETRIC_DECRYPT are for asymmetric keys. MAC is for message authentication codes. Only ENCRYPT_DECRYPT supports symmetric operations.

Answer

ASYMMETRIC_SIGN

Answer

ASYMMETRIC_DECRYPT

Answer

MAC

Question 5

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) such as credit card numbers and social security numbers. The scanning must be performed on a schedule (every week). Which GCP service and resource should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) with a DLP job trigger. Cloud DLP can inspect data for sensitive info types. DLP job triggers allow scheduling recurring scans of Cloud Storage, BigQuery, or Datastore. The trigger runs the inspection job based on a schedule.

Answer

Cloud Security Command Center (SCC)

Answer

Cloud Asset Inventory

Answer

Cloud Audit Logs

Question 6

A financial institution is required to store customer transaction data within the European Union to comply with GDPR data residency requirements. They want to prevent users from creating resources in any region outside the EU. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint gcp.resourceLocations restricts the locations where Google Cloud resources can be created. By setting a list of allowed locations (e.g., europe-west1, europe-west4), resources cannot be created in non-EU regions.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/sql.restrictAuthorizedNetworks

Question 7

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

Accepted Answer

The old key version remains available for decryption of existing data.. When a key is rotated, a new version is created. Data encrypted with the old version can still be decrypted because the old version remains available for decryption. The key material is not destroyed unless manually deleted. Automatic rotation does not re-encrypt existing data.

Answer

The old key version is immediately disabled, and all data must be re-encrypted.

Answer

Data encrypted with the old key is automatically re-encrypted with the new key.

Answer

The old key version is deleted after the rotation period.

Question 8

A security administrator wants to receive near-real-time logs whenever a Google Cloud support engineer accesses their customer content. Which GCP service provides this capability?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of actions taken by Google personnel when accessing customer content. It is part of the Assured Workloads offering and can be enabled for supported services.

Answer

Cloud Audit Logs (Admin Activity)

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs (Data Access)

Question 9

A company uses Cloud DLP to de-identify a dataset containing customer phone numbers. They need to replace each phone number with a consistently masked value that preserves the format (e.g., XXX-XXX-1234) but cannot be reversed. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig is the correct choice because it irreversibly replaces characters in a string while preserving the format. In this scenario, the customer phone numbers need to be consistently masked (e.g., replacing all but the last four digits with 'X') so that the output maintains the pattern XXX-XXX-1234, and the original value cannot be recovered. MaskingConfig supports character-level replacement with a fixed character (like 'X') and can preserve the original length and formatting, which meets the requirement for a non-reversible, format-preserving de-identification.

Answer

DateShiftConfig

Answer

CryptoReplaceFfxFpeConfig

Answer

BucketingConfig

Question 10

An organization wants to use a FIPS 140-2 Level 3 validated hardware security module (HSM) to protect encryption keys in Cloud KMS. Which key protection level should they choose when creating a key ring?

Accepted Answer

hsm. Cloud KMS offers two protection levels: software and HSM. HSM protection level uses Cloud HSM, which is FIPS 140-2 Level 3 validated. Software keys are validated to Level 1.

Answer

software

Answer

cloud

Answer

external

Question 11

A security engineer accidentally deleted a Cloud KMS key version. The key version is in the state DESTROY_SCHEDULED. How long does the engineer have to cancel the destruction before the key material is permanently destroyed?

Accepted Answer

24 hours. When a key version is scheduled for destruction, it enters a pending destruction grace period. The default grace period is 24 hours, during which the destruction can be canceled. After that, the key material is destroyed and unrecoverable.

Answer

30 days

Answer

Immediate destruction, no grace period

Answer

7 days

Question 12

A data scientist needs to access a secret stored in Secret Manager from a Compute Engine VM. The VM has the default service account attached. Which IAM role should be granted to the service account to allow reading the secret?

Accepted Answer

roles/secretmanager.secretAccessor. The correct role is roles/secretmanager.secretAccessor because it grants the specific permission secretmanager.versions.access required to read the secret payload from Secret Manager. The default Compute Engine service account needs only this minimal permission to retrieve the secret value, following the principle of least privilege.

Answer

roles/secretmanager.admin

Answer

roles/iam.serviceAccountUser

Answer

roles/secretmanager.viewer

Question 13

A company needs to enforce that all data stored in Cloud Storage and BigQuery is encrypted with customer-managed keys (CMEK). Which TWO actions should they take? (Choose two.)

Accepted Answer

Set the organization policy constraint 'constraints/gcp.cmeKRequired' for Cloud Storage and BigQuery.. To enforce CMEK, a CMEK key must be created in Cloud KMS and then configured on the resources (buckets, datasets). An organization policy can also be set to require CMEK for certain services. Creating a Cloud HSM key is a type of CMEK but is not specifically required.

Answer

Enable Access Transparency logs.

Answer

Create a Cloud HSM key to ensure FIPS 140-2 Level 3 compliance.

Answer

Use Cloud DLP to inspect and classify data.

Question 14

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data before loading it into another BigQuery dataset for analysis. Which THREE components must be configured? (Choose three.)

Accepted Answer

A DLP job trigger. To automatically de-identify data from BigQuery, a DLP job must be configured with a de-identification template. The inspection template identifies sensitive info types. The job can write results to a new BigQuery table. A job trigger schedules the job.

Answer

A Cloud KMS key for encryption of the output

Answer

A BigQuery authorized view

Question 15

A company needs to meet the EU data boundary requirements for Assured Workloads, ensuring that data processing and storage remain within the European Union. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create an Assured Workloads folder with a location of 'eu'.. Assured Workloads provides a folder with specific compliance controls. The organization policy constraint gcp.resourceLocations restricts resource creation to allowed regions. The folder itself is created in a specific location (e.g., eu) to enforce the boundary.

Answer

Enable Cloud Logging with log sinks in the US.

Answer

Enable Access Approval for all projects.

Answer

Use a CMEK key from a key ring in a non-EU region.