PCSE Ensuring Data Protection Practice Test 3 — 15 Questions

Question 1

A company uses BigQuery to store sensitive customer data. They want to restrict access to certain columns (e.g., email and SSN) so that only authorized users see the actual values, while other users see a masked version. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use BigQuery column-level security with policy tags and data masking rules.. BigQuery column-level security with policy tags lets you classify sensitive columns (email, SSN) with taxonomy-based policy tags and then apply data masking rules so that users with different roles see either the actual value, a masked value, or nothing. This is the native, centralized approach that enforces access at query time without duplicating data.

Answer

Create separate views for different user groups, each with different column projections.

Answer

Use Cloud Storage signed URLs to grant time-limited access to the data.

Answer

Use Cloud DLP to scan BigQuery tables and create de-identification jobs that permanently mask the data in the table.

Question 2

A healthcare organization must ensure that Protected Health Information (PHI) stored in Cloud Storage buckets is not inadvertently shared. They want to automatically scan all new objects added to the bucket for sensitive data and log findings. Which approach should they use?

Accepted Answer

Use Cloud DLP inspection job triggers with a schedule to scan the bucket periodically.. Cloud DLP inspection job triggers with a schedule allow automatic, recurring scanning of Cloud Storage buckets for sensitive data such as PHI, with findings logged for review. This satisfies the requirement to automatically scan new objects and log findings without manual intervention, using DLP's built-in infoType detectors for healthcare identifiers.

Answer

Use Data Loss Prevention (DLP) API to manually scan the bucket each time a new object is added.

Answer

Use Access Transparency logs to monitor all access to the bucket.

Answer

Use Cloud Audit Logs and create a log-based metric to detect sensitive data.

Question 3

An engineer needs to configure automatic key rotation for a symmetric encryption key in Cloud KMS. They have set the rotation period to 90 days. What happens to the old key material after rotation?

Accepted Answer

The old key version remains enabled and can still be used for decryption.. In Cloud KMS, automatic rotation creates a new primary key version but does not destroy or disable prior versions. Old key versions remain enabled and available for decryption, which is essential because data encrypted before rotation was encrypted with those older versions and must still be decryptable. Only the new version is used for new encryption operations, while all enabled versions can decrypt.

Answer

The old key version is disabled and can be re-enabled if needed.

Answer

The old key material is immediately deleted.

Answer

The old key material is moved to a pending destruction state for 24 hours.

Question 4

After deleting a Cloud KMS key version, an engineer receives an error when trying to decrypt data that was encrypted with that key version. The key version was deleted 12 hours ago. What is the most likely cause?

Accepted Answer

The key version was destroyed immediately upon deletion because the grace period is configurable.. In Google Cloud KMS, deleting a key version does not destroy it immediately by default — it enters a 'scheduled for destruction' state with a default 24-hour grace period during which it can be restored. However, the destruction duration is configurable (from 24 hours down to as little as 0), so if the engineer set a shorter or zero grace period, the key version would already be permanently destroyed 12 hours later, making decryption impossible. This matches option D, which correctly identifies that the grace period is configurable and can result in immediate destruction.

Answer

The key version was automatically rotated and is no longer the primary.

Answer

The key version is disabled and needs to be re-enabled.

Answer

The key version is in a pending destruction state and can be restored within 24 hours.

Question 5

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data as it is inserted into a new table using a DLP de-identification template. Which approach should they use?

Accepted Answer

Create a DLP de-identification template and apply it to the BigQuery table using a DLP job.. The correct approach is to create a DLP de-identification template and apply it to the BigQuery table using a DLP job. Cloud DLP supports de-identification templates that define transformations like masking, tokenization, or redaction. These templates can be applied directly to BigQuery data via a DLP job, which can be configured to run on a schedule or triggered by new data. This automates the de-identification process as data is inserted into the new table, ensuring sensitive data is protected without manual intervention.

Answer

Use Cloud Audit Logs to monitor insertions and manually run a DLP transformation.

Answer

Use Cloud DLP inspection job triggers to scan the table and send notifications.

Answer

Use BigQuery column-level security with data masking rules.

Question 6

A company wants to automatically rotate secrets stored in Secret Manager every 30 days. They have set up a Pub/Sub topic and a Cloud Function to perform the rotation. Which TWO actions are required to complete the configuration? (Choose two.)

Accepted Answer

Set the rotation period on the secret to 30 days.. Option B is correct because Secret Manager's rotation schedule is defined by setting the rotation period (e.g., 30 days) on the secret itself; this is what causes Secret Manager to publish rotation notifications to the configured Pub/Sub topic. Option E is correct because the secret must be configured with a Pub/Sub topic (via the rotation configuration) so that Secret Manager sends the rotation notification message that triggers the Cloud Function to perform the actual rotation. Option A is not required for the rotation trigger itself, since the Cloud Function's service account needs permissions to add a new secret version (e.g., secretmanager.secretVersionAdder or secretmanager.versions.add) rather than secretVersionManager, and the question asks about completing the rotation configuration, not the function's permissions. Option C is unnecessary because Secret Manager natively publishes rotation notifications based on the secret's rotation period, so no Cloud Scheduler job is needed to call the API every 30 days. Option D is incorrect because rotation is not enabled by a simple Console toggle; it is configured by setting the rotation period and Pub/Sub topic on the secret.

Answer

Grant the Cloud Functions service account the secretmanager.secretVersionManager role on the secret.

Answer

Create a Cloud Scheduler job to call the Secret Manager API every 30 days.

Answer

Enable automatic rotation in the Cloud Console by toggling the 'Enable rotation' switch.

Question 7

A security engineer is designing a data residency strategy for a healthcare organization that must keep all data within the European Union. They plan to use Assured Workloads to meet this requirement. Which THREE additional controls should they implement to further enforce data residency and protect data? (Choose three.)

Accepted Answer

Organization policy constraint gcp.resourceLocations set to allow only European regions.. Option A is correct because the organization policy constraint gcp.resourceLocations restricts where resources can be created, and setting it to allow only European regions programmatically enforces that new resources stay within the EU, directly supporting the data residency requirement. Option B is correct because VPC Service Controls create a service perimeter that blocks data exfiltration and access from outside approved regions, adding a strong network-level enforcement of residency beyond Assured Workloads' built-in controls. Option E is correct because Access Transparency logs provide visibility into when Google personnel access customer data, which is an important transparency and audit control for a healthcare organization handling sensitive data under strict residency rules. Option C is not correct because Cloud HSM stores and manages encryption keys but does not by itself enforce data residency or prevent data from leaving the EU. Option D is not correct because Cloud DLP scans for and classifies sensitive data, which helps with discovery and protection but does not enforce regional data residency.

Answer

Cloud HSM to store encryption keys.

Answer

Cloud DLP to scan for sensitive data.

Question 8

A company is using Cloud KMS with software keys for encryption. They want to increase security by using an HSM backend without changing their existing key rings or key names. Which TWO steps should they take? (Choose two.)

Accepted Answer

Create a new key version with the protection level set to HSM.. Option D is correct because Cloud KMS allows you to add a new key version to an existing key with the protection level set to HSM, which preserves the key ring and key name while upgrading the cryptographic backing. Option E is correct because updating the key's default protection level to HSM ensures that subsequently created key versions automatically use an HSM backend, again without renaming or moving the key. Together, these steps let the company adopt HSM protection while keeping existing key rings and key names intact. Option A is wrong because creating a new key ring and migrating keys would change the key ring resource path and is unnecessary. Option B is wrong because a key version's protection level is immutable after creation and cannot be changed via the API. Option C is wrong because deleting and recreating key versions destroys key material and breaks existing ciphertext, and it is not required to switch to HSM protection.

Answer

Create a new key ring and migrate all keys to it.

Answer

Change the protection level of the existing key version to HSM using the API.

Answer

Delete the existing software key versions and recreate them with HSM protection.

Question 9

A security engineer needs to ensure that all data stored in Cloud Storage buckets and BigQuery tables is encrypted at rest using keys that the organization generates and manages on-premises. The keys must not be stored by Google. Which key management approach should they use?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own encryption keys with each API call. Google never stores these keys, ensuring the customer retains full control. GMEK and CMEK involve Google storing the keys, and Cloud HSM is a managed service that stores keys, so none meet the 'not stored by Google' requirement.

Answer

Cloud HSM with Customer-Managed Keys

Answer

Customer-Managed Encryption Keys (CMEK) via Cloud KMS

Answer

Google default encryption (GMEK)

Question 10

A company uses Cloud KMS to manage encryption keys for data at rest. They want to automatically rotate a symmetric key every 90 days. The key is used to encrypt Cloud Storage objects and BigQuery tables. What is the correct approach to achieve automatic rotation?

Accepted Answer

Set the rotation period on the key to 90 days and ensure the key purpose is ENCRYPT_DECRYPT.. Cloud KMS supports automatic rotation by setting a rotation period directly on a symmetric key whose purpose is ENCRYPT_DECRYPT. Setting the rotation period to 90 days causes Cloud KMS to automatically generate a new key version every 90 days, and existing data remains decryptable because old versions are retained. This is the native, supported mechanism.

Answer

Use a Cloud Function to rotate the key every 90 days via the Cloud KMS API.

Answer

Create a Cloud Scheduler job to manually rotate the key every 90 days.

Answer

Set the rotation period on the key ring to 90 days.

Question 11

A company must store API keys and database credentials securely in Google Cloud. They need automatic rotation of these secrets every 30 days, with notifications sent to a security team after each rotation. Which services should they use? (Choose TWO).

Accepted Answer

Secret Manager. Secret Manager (B) is the correct service for securely storing API keys and database credentials, and it supports automatic rotation by attaching a rotation schedule (e.g., every 30 days) and a Pub/Sub notification topic that fires on rotation events. Cloud Functions (D) is correct because Secret Manager's rotation feature invokes a user-defined rotation function (typically deployed as a Cloud Function) that implements the custom logic to generate new credentials and add a new secret version. Together, Secret Manager stores and schedules rotation while Cloud Functions performs the actual rotation and can trigger notifications to the security team via Pub/Sub. Cloud Scheduler (A) is not needed because Secret Manager natively handles the 30-day rotation schedule, so adding Cloud Scheduler would be redundant. Compute Engine (C) is for running VMs, not for secret storage or rotation logic. Cloud KMS (E) manages encryption keys, not application secrets like API keys and database credentials, so it does not fulfill the rotation requirement for these secrets.

Answer

Cloud Scheduler

Answer

Compute Engine

Answer

Cloud KMS

Question 12

A company is deploying a multi-region application that must store data only within the European Union to comply with GDPR data residency requirements. They also need to ensure that Google Cloud administrators cannot access customer content. Which two controls should they implement? (Choose TWO).

Accepted Answer

Apply the organization policy constraint gcp.resourceLocations with the allowed regions set to europe-west1, europe-west2, etc.. Option B is correct because the organization policy constraint gcp.resourceLocations restricts where resources can be created, and setting allowed values to EU regions such as europe-west1 and europe-west2 enforces data residency so data stays within the European Union. Option C is correct because Access Transparency provides logs of when Google administrators access customer content, giving visibility and an audit trail that supports the requirement that Google Cloud administrators cannot access customer content without disclosure. Option A is not correct here because VPC Service Controls creates a service perimeter to mitigate data exfiltration, not to enforce geographic data residency or log Google administrator access. Option D is not correct because Cloud DLP discovers and classifies sensitive data but does not by itself enforce EU-only storage or prevent Google administrator access. Option E is not correct because Assured Workloads with an EU regions boundary is a compliance-oriented control that can help with residency, but the question asks for the two specific controls matching the stated requirements, and the marked answers are the organization policy constraint and Access Transparency.

Answer

Use VPC Service Controls.

Answer

Configure Cloud DLP inspection jobs to scan for GDPR-sensitive data.

Answer

Enable Assured Workloads with EU regions boundary.

Question 13

A healthcare organization uses Cloud Healthcare API to store patient data in FHIR stores. They need to ensure that data is protected both at rest and in transit, and that access is audited. Which two configurations should they implement? (Choose two.)

Accepted Answer

Set up a Cloud KMS key ring and use CMEK to encrypt the FHIR store data at rest.. To protect data at rest and audit access, the organization should use CMEK to encrypt FHIR data at rest and enable Cloud Audit Logs for data access on the Cloud Healthcare API. These two configurations directly address the requirements. VPC Service Controls, uniform bucket-level access, and de-identification do not satisfy the specific needs of auditing access and controlling encryption keys.

Answer

Configure a VPC Service Controls perimeter around the Cloud Healthcare API.

Answer

Enable uniform bucket-level access on the Cloud Storage bucket used by the FHIR store.

Answer

Use Cloud DLP to de-identify all patient data before storing it in the FHIR store.

Question 14

A financial institution uses BigQuery to store transaction data. They need to ensure that a group of analysts can query the data but cannot see the values in a column named 'account_number'. The analysts must still be able to run queries that filter on 'account_number' without seeing the actual values. What should the security engineer implement?

Accepted Answer

Use dynamic data masking with a policy tag on the 'account_number' column and grant the analysts the fine-grained reader role.. Dynamic data masking with policy tags masks column values for users with the fine-grained reader role, but still allows them to filter on the masked column. Column-level access control denies access entirely, preventing filtering. Views that exclude the column also prevent filtering. Row-level security does not mask column values. Only dynamic data masking meets both requirements.

Answer

Use column-level access control with the policy tag 'Sensitive' on the 'account_number' column.

Answer

Create a view that excludes the 'account_number' column and grant the analysts access to the view.

Answer

Apply a row-level security policy that filters out rows where 'account_number' is sensitive.

Question 15

A financial services firm uses BigQuery to store transactional data. They need to ensure that analysts can query the data but cannot see plaintext credit card numbers. The analysts must still be able to join on the credit card numbers for aggregation. Which BigQuery feature should they use?

Accepted Answer

BigQuery dynamic data masking.. BigQuery dynamic data masking applies masking policies at query time based on the user's IAM roles. Analysts without the fine-grained reader role see masked values, but the query engine still uses the original data for joins and aggregations. This uniquely satisfies both constraints: join on credit card numbers and prevent plaintext visibility.

Answer

Cloud DLP de-identification transform applied during query execution.

Answer

Authorized views that exclude the credit card column.

Answer

Column-level security with policy tags using Data Catalog.