PCSE Ensuring Data Protection Practice Test 2 — 15 Questions

Question 1

An engineer needs to destroy a Cloud KMS key immediately due to a security incident. They disable the key and then schedule destruction. What is the default waiting period before the key is permanently destroyed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

24 hours. In Cloud KMS, when you schedule destruction of a key version, there is a default pending destruction grace period of 24 hours. During this time, you can cancel destruction. The key is not immediately destroyed.

Answer

Immediate destruction

Answer

7 days

Answer

30 days

Question 2

A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?

Accepted Answer

Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.. Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Answer

Use VPC Service Controls to prevent data exfiltration.

Answer

Set IAM conditions on all resources to allow only US regions.

Answer

Use Cloud DLP to scan and block data leaving the US.

Question 3

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Accepted Answer

Data Catalog taxonomy with policy tags. BigQuery column-level security requires a Data Catalog taxonomy with policy tags, and then BigQuery Data Policy to define masking rules (e.g., email masking). Policy tags alone provide access control but not masking; data policies provide the masking.

Answer

Cloud DLP de-identification templates

Answer

IAM roles with conditions on table

Answer

Cloud KMS key for encryption

Question 4

A company wants to implement automatic de-identification of sensitive data stored in Cloud Storage using Cloud DLP. They need to scan new objects as they are uploaded and apply a transformation to remove credit card numbers. Which three resources must they create? (Choose THREE.)

Accepted Answer

Cloud DLP job that uses the trigger and template. To automatically de-identify sensitive data in Cloud Storage using Cloud DLP, you must create three resources: a Cloud DLP job trigger (C) to initiate the scan when new objects are uploaded, a Cloud DLP de-identification template (E) that specifies the transformation (e.g., removing credit card numbers), and a Cloud DLP job (B) that references both the trigger and the de-identification template. The inspection template (A) is not required because the job can directly specify the infoTypes to inspect in its configuration.

Answer

Cloud DLP inspection template

Answer

Cloud Function to process objects

Question 5

Which two statements correctly describe Cloud KMS key versions? (Choose TWO.)

Accepted Answer

Key versions are immutable once created.. Key versions in Cloud KMS are immutable and each has its own key material. You can enable or disable versions for rotation. A key has multiple versions; rotation creates new versions. The state can be ENABLED, DISABLED, DESTROYED, etc. The grace period applies to destruction scheduling.

Answer

Key versions can be rotated automatically without creating a new version.

Answer

The destruction of a key version is immediate upon request.

Answer

Each key version can have a different purpose.

Question 6

An organization wants to encrypt data at rest using customer-managed keys on Compute Engine persistent disks. They need to provide the key material with each API call, and Google should never store the key. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own encryption keys, which are used to encrypt data at rest. The keys are provided with each API call and are not stored by Google. CMEK uses Cloud KMS where Google stores the key material (encrypted by HSM). GMEK is Google-managed. Cloud HSM is a service for managing keys but still stores them.

Answer

Cloud HSM

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK)

Question 7

A security engineer wants to automatically rotate a database password stored in Secret Manager every 30 days. The new password should be generated and stored in Secret Manager without manual intervention. Which approach meets these requirements?

Accepted Answer

Configure a rotation period in Secret Manager, set a Pub/Sub topic, and implement a Cloud Function that listens for rotation messages to generate and add a new secret version.. Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Answer

Set up a Cloud Lifecycle rule to delete the old secret version and create a new one with the same value.

Answer

Use a Cloud KMS key to re-encrypt the secret each month.

Answer

Use gcloud secrets versions add with a scheduled Cloud Scheduler job that generates a new password and adds it as a new version.

Question 8

A healthcare company stores patient data in BigQuery and needs to mask sensitive columns like SSN and email for analysts who do not need to see the actual values. They want to apply consistent masking across queries without modifying the underlying data. Which feature should they use?

Accepted Answer

BigQuery Data Policy with data masking rules. BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Answer

IAM conditions on tables

Answer

Authorized views with row-level security

Answer

Cloud DLP de-identification transforms on export

Question 9

A company uses Cloud KMS with an HSM key for encryption of sensitive data. The compliance team requires that the key material never leaves the HSM boundary. They plan to use the key for symmetric encryption/decryption. Which key purpose should they specify when creating the key?

Accepted Answer

ENCRYPT_DECRYPT. For symmetric encryption/decryption, the key purpose must be ENCRYPT_DECRYPT. ASYMMETRIC_SIGN and ASYMMETRIC_DECRYPT are for asymmetric keys. MAC is for message authentication codes. Only ENCRYPT_DECRYPT supports symmetric operations.

Answer

ASYMMETRIC_SIGN

Answer

ASYMMETRIC_DECRYPT

Answer

MAC

Question 10

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) such as credit card numbers and social security numbers. The scanning must be performed on a schedule (every week). Which GCP service and resource should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) with a DLP job trigger. Cloud DLP can inspect data for sensitive info types. DLP job triggers allow scheduling recurring scans of Cloud Storage, BigQuery, or Datastore. The trigger runs the inspection job based on a schedule.

Answer

Cloud Security Command Center (SCC)

Answer

Cloud Asset Inventory

Answer

Cloud Audit Logs

Question 11

A financial institution is required to store customer transaction data within the European Union to comply with GDPR data residency requirements. They want to prevent users from creating resources in any region outside the EU. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint gcp.resourceLocations restricts the locations where Google Cloud resources can be created. By setting a list of allowed locations (e.g., europe-west1, europe-west4), resources cannot be created in non-EU regions.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/sql.restrictAuthorizedNetworks

Question 12

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

Accepted Answer

The old key version remains available for decryption of existing data.. When a key is rotated, a new version is created. Data encrypted with the old version can still be decrypted because the old version remains available for decryption. The key material is not destroyed unless manually deleted. Automatic rotation does not re-encrypt existing data.

Answer

The old key version is immediately disabled, and all data must be re-encrypted.

Answer

Data encrypted with the old key is automatically re-encrypted with the new key.

Answer

The old key version is deleted after the rotation period.

Question 13

A security administrator wants to receive near-real-time logs whenever a Google Cloud support engineer accesses their customer content. Which GCP service provides this capability?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of actions taken by Google personnel when accessing customer content. It is part of the Assured Workloads offering and can be enabled for supported services.

Answer

Cloud Audit Logs (Admin Activity)

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs (Data Access)

Question 14

An organization wants to use a FIPS 140-2 Level 3 validated hardware security module (HSM) to protect encryption keys in Cloud KMS. Which key protection level should they choose when creating a key ring?

Accepted Answer

hsm. Cloud KMS offers two protection levels: software and HSM. HSM protection level uses Cloud HSM, which is FIPS 140-2 Level 3 validated. Software keys are validated to Level 1.

Answer

software

Answer

cloud

Answer

external

Question 15

A security engineer accidentally deleted a Cloud KMS key version. The key version is in the state DESTROY_SCHEDULED. How long does the engineer have to cancel the destruction before the key material is permanently destroyed?

Accepted Answer

24 hours. When a key version is scheduled for destruction, it enters a pending destruction grace period. The default grace period is 24 hours, during which the destruction can be canceled. After that, the key material is destroyed and unrecoverable.

Answer

30 days

Answer

Immediate destruction, no grace period

Answer

7 days