PCSE Ensuring Data Protection Practice Test 3 — 15 Questions

Question 1

A company needs to enforce that all data stored in Cloud Storage and BigQuery is encrypted with customer-managed keys (CMEK). Which TWO actions should they take? (Choose two.)

Accepted Answer

Set the organization policy constraint 'constraints/gcp.cmeKRequired' for Cloud Storage and BigQuery.. To enforce CMEK, a CMEK key must be created in Cloud KMS and then configured on the resources (buckets, datasets). An organization policy can also be set to require CMEK for certain services. Creating a Cloud HSM key is a type of CMEK but is not specifically required.

Answer

Enable Access Transparency logs.

Answer

Create a Cloud HSM key to ensure FIPS 140-2 Level 3 compliance.

Answer

Use Cloud DLP to inspect and classify data.

Question 2

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data before loading it into another BigQuery dataset for analysis. Which THREE components must be configured? (Choose three.)

Accepted Answer

A DLP job trigger. To automatically de-identify data from BigQuery, a DLP job must be configured with a de-identification template. The inspection template identifies sensitive info types. The job can write results to a new BigQuery table. A job trigger schedules the job.

Answer

A Cloud KMS key for encryption of the output

Answer

A BigQuery authorized view

Question 3

A company needs to meet the EU data boundary requirements for Assured Workloads, ensuring that data processing and storage remain within the European Union. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create an Assured Workloads folder with a location of 'eu'.. Assured Workloads provides a folder with specific compliance controls. The organization policy constraint gcp.resourceLocations restricts resource creation to allowed regions. The folder itself is created in a specific location (e.g., eu) to enforce the boundary.

Answer

Enable Cloud Logging with log sinks in the US.

Answer

Enable Access Approval for all projects.

Answer

Use a CMEK key from a key ring in a non-EU region.

Question 4

A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud HSM. CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with software keys

Answer

Customer-supplied encryption keys (CSEK)

Question 5

A security engineer needs to store database credentials and API keys securely in GCP. The solution must support automatic rotation of secrets at a defined schedule and trigger a Cloud Function after each rotation to update dependent applications. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports versioning, IAM access, and automatic rotation with Pub/Sub notifications. Cloud Functions can subscribe to the Pub/Sub topic to perform post-rotation tasks. Cloud KMS manages keys, not secrets. Cloud DLP is for data loss prevention. Cloud Storage is not designed for secret management with rotation.

Answer

Cloud KMS

Answer

Cloud DLP

Answer

Cloud Storage

Question 6

A company uses Cloud DLP to scan a BigQuery table containing customer data. They want to de-identify credit card numbers so that the first 12 digits are masked with 'X' and the last 4 digits remain visible. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig with a masking character 'X' and a character mask range from -12 to -1 (or similar) can achieve this. However, for consistent de-identification of credit card numbers, the CryptoReplaceFfxFpeConfig with an appropriate range might be used, but it preserves format. The direct mask is MaskingConfig. The correct answer is MaskingConfig as it allows masking specific character ranges. The other options: DateShiftConfig shifts dates, BucketingConfig groups values, and CryptoReplaceFfxFpeConfig preserves format but does not mask.

Answer

DateShiftConfig

Answer

BucketingConfig

Answer

CryptoReplaceFfxFpeConfig

Question 7

A security engineer needs to enforce that all new Compute Engine disks are created in a specific geographic region to meet data residency requirements. Which organization policy constraint should they use?

Accepted Answer

gcp.resourceLocations. The constraint 'gcp.resourceLocations' restricts where Google Cloud resources can be created. It can be set to a list of allowed locations. The other constraints: 'iam.allowedPolicyMemberDomains' restricts member domains, 'compute.skipDefaultNetworkCreation' prevents default network creation, 'constraints/compute.trustedImageProjects' restricts image projects.

Answer

constraints/compute.trustedImageProjects

Answer

compute.skipDefaultNetworkCreation

Answer

iam.allowedPolicyMemberDomains

Question 8

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They want to rotate the key automatically every 90 days. What must the security engineer configure to achieve this?

Accepted Answer

Set the rotation period on the key to 7776000 seconds. In Cloud KMS, key rotation can be automatic by setting a rotation period on a key. The rotation period is configured in seconds (e.g., 90 days = 7776000 seconds). Manual rotation via the console or API is not automatic. The key purpose does not affect rotation capability; ENCRYPT_DECRYPT supports rotation.

Answer

Use a key with ASYMMETRIC_SIGN purpose

Answer

Set the key version state to 'disabled' after 90 days

Answer

Manually rotate the key every 90 days using gcloud command

Question 9

A company uses CMEK with Cloud HSM to encrypt a BigQuery table. The security engineer accidentally deleted the key in Cloud KMS. The key is now in a 'pending destruction' state with a grace period of 24 hours. Which action should the engineer take to restore the key and avoid data loss?

Accepted Answer

Restore the key by canceling the destruction within the grace period. When a key is destroyed, it enters a pending destruction state for a default 24-hour grace period. During this period, the key can be restored by cancelling the destruction. After the grace period, the key is permanently destroyed and data encrypted with it becomes inaccessible. The restore operation is available in Cloud KMS.

Answer

Recreate the key with the same name and version

Answer

Wait for the grace period to expire and then use a backup key

Answer

Use Access Transparency logs to recover the key material

Question 10

A security engineer needs to ensure that sensitive columns in BigQuery are automatically masked for certain users. For example, the email column should show only the domain for users with a specific role. Which two services must be configured together?

Accepted Answer

Data Catalog and BigQuery Data Policy. BigQuery column-level security uses policy tags attached to columns, which are defined in Data Catalog taxonomies. To apply masking, you need to use BigQuery Data Policy (also known as data masking) which uses policy tags to define masking rules. Data Catalog provides the taxonomy for policy tags, while BigQuery Data Policy applies the actual masking. IAM roles for masking are granted via the policy tags.

Answer

Cloud IAM and VPC Service Controls

Answer

Secret Manager and Cloud Functions

Answer

Cloud DLP and Cloud KMS

Question 11

A company needs to store sensitive API keys in Secret Manager and ensure that only a specific service account can access the latest version of a secret. Which IAM permission is required for the service account to read the secret value?

Accepted Answer

secretmanager.versions.access. To access a secret version's payload (the actual secret value), the permission 'secretmanager.versions.access' is required. The role 'roles/secretmanager.secretAccessor' includes this permission. The other permissions are for listing or managing metadata.

Answer

secretmanager.secrets.get

Answer

secretmanager.secrets.create

Answer

secretmanager.versions.list

Question 12

A security engineer needs to view logs of Google Cloud support engineers accessing their data to meet compliance requirements. Which GCP feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of Google admin access to customer content. It is available for certain services like Compute Engine, Cloud Storage, BigQuery, etc. Audit Logs record actions performed by users in the customer's project, not Google staff. Access Approval is a separate feature that allows customers to approve or deny access requests. VPC Flow Logs record network traffic, not admin access.

Answer

Access Approval

Answer

Audit Logs

Answer

VPC Flow Logs

Question 13

A company wants to enforce that all BigQuery datasets are created in the 'US' multi-region to comply with data residency policies. Which organization policy constraint can achieve this?

Accepted Answer

gcp.resourceLocations. The 'gcp.resourceLocations' constraint restricts the locations where resources can be created. By setting the allowed locations to 'us' (or specific US regions), BigQuery datasets must be created in those locations. The other constraints: 'constraints/bigquery.restrictDatasetLocation' is not a valid organization policy. 'constraints/gcp.restrictNoncompliantResources' is not specific to locations. 'constraints/compute.trustedImageProjects' is for images.

Answer

constraints/gcp.restrictNoncompliantResources

Answer

constraints/compute.trustedImageProjects

Answer

constraints/bigquery.restrictDatasetLocation

Question 14

A security engineer needs to implement de-identification of sensitive data in a Cloud Storage bucket using Cloud DLP. They want to inspect the data for credit card numbers and then replace them with a tokenized value that preserves the format for downstream processing. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure an inspection job with the built-in CREDIT_CARD_NUMBER infoType. To de-identify credit card numbers while preserving format, the engineer should use a DLP inspection job first to identify the sensitive data, then apply a de-identification transform using CryptoReplaceFfxFpeConfig which replaces the data with a token that preserves the format. The other options: BucketingConfig groups values, DateShiftConfig shifts dates, and using a custom infoType is not necessary if the built-in CREDIT_CARD_NUMBER works.

Answer

Use the DateShiftConfig de-identification transform

Answer

Create a custom infoType for credit card numbers

Answer

Use the BucketingConfig de-identification transform

Question 15

A company must comply with regulatory requirements that restrict data access by Google Cloud support and engineering staff. They need to log all Google admin access to their data and also require explicit approval before access is granted. Which TWO features should they combine? (Choose two.)

Accepted Answer

Access Approval. Access Transparency provides logs of Google admin access to customer content. Access Approval allows customers to approve or deny Google support access requests. Together, they satisfy the requirement for logging and approval. The other options: Audit Logs record customer project actions, not Google admin access. Data Loss Prevention is for data inspection. VPC Service Controls are for network perimeters.

Answer

Data Loss Prevention

Answer

VPC Service Controls

Answer

Audit Logs