PCSE Ensuring Data Protection Practice Test 3 — 15 Questions

Question 1

A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud HSM. CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with software keys

Answer

Customer-supplied encryption keys (CSEK)

Question 2

A security engineer needs to store database credentials and API keys securely in GCP. The solution must support automatic rotation of secrets at a defined schedule and trigger a Cloud Function after each rotation to update dependent applications. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports versioning, IAM access, and automatic rotation with Pub/Sub notifications. Cloud Functions can subscribe to the Pub/Sub topic to perform post-rotation tasks. Cloud KMS manages keys, not secrets. Cloud DLP is for data loss prevention. Cloud Storage is not designed for secret management with rotation.

Answer

Cloud KMS

Answer

Cloud DLP

Answer

Cloud Storage

Question 3

A company uses Cloud DLP to scan a BigQuery table containing customer data. They want to de-identify credit card numbers so that the first 12 digits are masked with 'X' and the last 4 digits remain visible. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig with a masking character 'X' and a character mask range from -12 to -1 (or similar) can achieve this. However, for consistent de-identification of credit card numbers, the CryptoReplaceFfxFpeConfig with an appropriate range might be used, but it preserves format. The direct mask is MaskingConfig. The correct answer is MaskingConfig as it allows masking specific character ranges. The other options: DateShiftConfig shifts dates, BucketingConfig groups values, and CryptoReplaceFfxFpeConfig preserves format but does not mask.

Answer

DateShiftConfig

Answer

BucketingConfig

Answer

CryptoReplaceFfxFpeConfig

Question 4

A security engineer needs to enforce that all new Compute Engine disks are created in a specific geographic region to meet data residency requirements. Which organization policy constraint should they use?

Accepted Answer

gcp.resourceLocations. The constraint 'gcp.resourceLocations' restricts where Google Cloud resources can be created. It can be set to a list of allowed locations. The other constraints: 'iam.allowedPolicyMemberDomains' restricts member domains, 'compute.skipDefaultNetworkCreation' prevents default network creation, 'constraints/compute.trustedImageProjects' restricts image projects.

Answer

constraints/compute.trustedImageProjects

Answer

compute.skipDefaultNetworkCreation

Answer

iam.allowedPolicyMemberDomains

Question 5

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They want to rotate the key automatically every 90 days. What must the security engineer configure to achieve this?

Accepted Answer

Set the rotation period on the key to 7776000 seconds. In Cloud KMS, key rotation can be automatic by setting a rotation period on a key. The rotation period is configured in seconds (e.g., 90 days = 7776000 seconds). Manual rotation via the console or API is not automatic. The key purpose does not affect rotation capability; ENCRYPT_DECRYPT supports rotation.

Answer

Use a key with ASYMMETRIC_SIGN purpose

Answer

Set the key version state to 'disabled' after 90 days

Answer

Manually rotate the key every 90 days using gcloud command

Question 6

A company uses CMEK with Cloud HSM to encrypt a BigQuery table. The security engineer accidentally deleted the key in Cloud KMS. The key is now in a 'pending destruction' state with a grace period of 24 hours. Which action should the engineer take to restore the key and avoid data loss?

Accepted Answer

Restore the key by canceling the destruction within the grace period. When a key is destroyed, it enters a pending destruction state for a default 24-hour grace period. During this period, the key can be restored by cancelling the destruction. After the grace period, the key is permanently destroyed and data encrypted with it becomes inaccessible. The restore operation is available in Cloud KMS.

Answer

Recreate the key with the same name and version

Answer

Wait for the grace period to expire and then use a backup key

Answer

Use Access Transparency logs to recover the key material

Question 7

A security engineer needs to ensure that sensitive columns in BigQuery are automatically masked for certain users. For example, the email column should show only the domain for users with a specific role. Which two services must be configured together?

Accepted Answer

Data Catalog and BigQuery Data Policy. BigQuery column-level security uses policy tags attached to columns, which are defined in Data Catalog taxonomies. To apply masking, you need to use BigQuery Data Policy (also known as data masking) which uses policy tags to define masking rules. Data Catalog provides the taxonomy for policy tags, while BigQuery Data Policy applies the actual masking. IAM roles for masking are granted via the policy tags.

Answer

Cloud IAM and VPC Service Controls

Answer

Secret Manager and Cloud Functions

Answer

Cloud DLP and Cloud KMS

Question 8

A company needs to store sensitive API keys in Secret Manager and ensure that only a specific service account can access the latest version of a secret. Which IAM permission is required for the service account to read the secret value?

Accepted Answer

secretmanager.versions.access. To access a secret version's payload (the actual secret value), the permission 'secretmanager.versions.access' is required. The role 'roles/secretmanager.secretAccessor' includes this permission. The other permissions are for listing or managing metadata.

Answer

secretmanager.secrets.get

Answer

secretmanager.secrets.create

Answer

secretmanager.versions.list

Question 9

A company wants to use Cloud DLP to inspect Cloud Storage buckets for phone numbers that match a custom pattern (e.g., +1-XXX-XXX-XXXX). The pattern is not covered by built-in infoTypes. How should the engineer configure the DLP job?

Accepted Answer

Create a custom infoType with a regex pattern. Option A is correct because Cloud DLP allows you to define custom infoTypes using regular expressions to match patterns not covered by built-in infoTypes. By creating a custom infoType with a regex pattern like `\+1-\d{3}-\d{3}-\d{4}`, the DLP job can inspect Cloud Storage buckets for phone numbers in the specified format. This approach directly addresses the requirement without relying on external services or unsupported built-in types.

Answer

Use the built-in PHONE_NUMBER infoType

Answer

Use Cloud Functions to scan the files and call DLP API

Answer

Store the pattern in Secret Manager and reference it in the DLP job

Question 10

A security engineer needs to view logs of Google Cloud support engineers accessing their data to meet compliance requirements. Which GCP feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of Google admin access to customer content. It is available for certain services like Compute Engine, Cloud Storage, BigQuery, etc. Audit Logs record actions performed by users in the customer's project, not Google staff. Access Approval is a separate feature that allows customers to approve or deny access requests. VPC Flow Logs record network traffic, not admin access.

Answer

Access Approval

Answer

Audit Logs

Answer

VPC Flow Logs

Question 11

A company wants to enforce that all BigQuery datasets are created in the 'US' multi-region to comply with data residency policies. Which organization policy constraint can achieve this?

Accepted Answer

gcp.resourceLocations. The 'gcp.resourceLocations' constraint restricts the locations where resources can be created. By setting the allowed locations to 'us' (or specific US regions), BigQuery datasets must be created in those locations. The other constraints: 'constraints/bigquery.restrictDatasetLocation' is not a valid organization policy. 'constraints/gcp.restrictNoncompliantResources' is not specific to locations. 'constraints/compute.trustedImageProjects' is for images.

Answer

constraints/gcp.restrictNoncompliantResources

Answer

constraints/compute.trustedImageProjects

Answer

constraints/bigquery.restrictDatasetLocation

Question 12

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to rotate the key used for an existing disk without recreating the disk. What must the engineer do?

Accepted Answer

Detach the disk and reattach it with the new CSEK key. Option A is correct because CSEK keys are not stored in Google Cloud; they are provided by the customer at the time of disk attachment. To rotate the key, you must detach the disk and reattach it with the new CSEK key, as the key is only used during the attach operation to encrypt the disk's data encryption keys (DEKs). The disk itself is not re-encrypted; the new key is used to wrap the DEKs for future reads/writes.

Answer

Rotate the key in Cloud KMS and the disk will automatically use it

Answer

Create a snapshot of the disk and restore it with a new CMEK key

Answer

Use gcloud compute disks update with the new key

Question 13

A security engineer needs to implement de-identification of sensitive data in a Cloud Storage bucket using Cloud DLP. They want to inspect the data for credit card numbers and then replace them with a tokenized value that preserves the format for downstream processing. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure an inspection job with the built-in CREDIT_CARD_NUMBER infoType. To de-identify credit card numbers while preserving format, the engineer should use a DLP inspection job first to identify the sensitive data, then apply a de-identification transform using CryptoReplaceFfxFpeConfig which replaces the data with a token that preserves the format. The other options: BucketingConfig groups values, DateShiftConfig shifts dates, and using a custom infoType is not necessary if the built-in CREDIT_CARD_NUMBER works.

Answer

Use the DateShiftConfig de-identification transform

Answer

Create a custom infoType for credit card numbers

Answer

Use the BucketingConfig de-identification transform

Question 14

A company must comply with regulatory requirements that restrict data access by Google Cloud support and engineering staff. They need to log all Google admin access to their data and also require explicit approval before access is granted. Which TWO features should they combine? (Choose two.)

Accepted Answer

Access Approval. Access Transparency provides logs of Google admin access to customer content. Access Approval allows customers to approve or deny Google support access requests. Together, they satisfy the requirement for logging and approval. The other options: Audit Logs record customer project actions, not Google admin access. Data Loss Prevention is for data inspection. VPC Service Controls are for network perimeters.

Answer

Data Loss Prevention

Answer

VPC Service Controls

Answer

Audit Logs

Question 15

A company wants to use Cloud KMS to encrypt data in Cloud Storage with a key that is automatically rotated every 30 days. They also want to ensure that the key material is stored in a HSM. Which TWO resources must they create? (Choose two.)

Accepted Answer

A Cloud HSM key ring. To use CMEK with Cloud HSM, the engineer needs to create a Cloud HSM key ring (which is a resource that groups keys) and a cryptographic key with protection level HSM. The key ring is created first, then the key is created within it. The other options: a key ring with software protection level would not use HSM; a Cloud KMS key is created within a key ring, so both are needed.

Answer

A key with purpose EXTERNAL

Answer

A key ring with protection level software

Answer

A Cloud HSM cluster