PCSE Ensuring Data Protection Practice Test 4 — 15 Questions

Question 1

A security engineer wants to encrypt data at rest in Cloud Storage using a key that Google manages but the customer can control the key material. They need to rotate the key automatically every 90 days. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) via Cloud KMS. Customer-Managed Encryption Keys (CMEK) using Cloud KMS allow customers to manage their own key material and configure automatic rotation (minimum 24h, but typically set to 90 days). GMEK is Google-managed (no customer control), CSEK requires customer to supply key with each API call (Google never stores it), and Cloud HSM is a key management service but still uses CMEK integration for rotation.

Answer

Google default encryption (GMEK)

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Cloud HSM

Question 2

An organization needs to store API keys and database credentials in a central, auditable service with versioning and IAM access control. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing secrets like API keys, certificates, and database passwords. It provides versioning, IAM policies (e.g., secretmanager.versions.access), and automatic rotation with Pub/Sub notifications.

Answer

Cloud HSM

Answer

Cloud DLP

Answer

Cloud KMS

Question 3

A company uses Cloud DLP to scan a BigQuery table for sensitive data. They want to automatically mask credit card numbers in query results for users who are not data stewards. Which approach should they use?

Accepted Answer

Create a BigQuery Data Policy with masking rules on the column and assign appropriate IAM roles. BigQuery column-level security with data masking rules (via BigQuery Data Policy) allows defining masking policies (e.g., email masking, hash masking) that are automatically applied to query results based on user IAM. DLP inspection can identify the sensitive columns, but the masking is enforced by BigQuery policies.

Answer

Enable Access Transparency to log queries and manually review

Answer

Use Cloud DLP de-identification jobs to replace credit card numbers with tokens in the source table

Answer

Use Cloud DLP inspect job and then manually apply a view that masks the column

Question 4

A financial institution must store data in specific EU regions to comply with GDPR. They want to prevent users from creating resources in other regions. Which organization policy should they set?

Accepted Answer

Set the `gcp.resourceLocations` constraint at the organization or folder level. The `gcp.resourceLocations` organization policy constraint is the correct mechanism to restrict where resources can be created in Google Cloud. By setting this list constraint at the organization or folder level, you can specify allowed locations (e.g., EU regions), and any attempt to create a resource outside those regions will be denied. This directly enforces GDPR data residency requirements without relying on IAM roles or service-specific configurations.

Answer

Use IAM roles to restrict Compute Engine instance creation

Answer

Create an Assured Workloads folder with EU data boundary

Answer

Configure Cloud KMS key ring location constraint

Question 5

A security engineer needs to audit all administrative actions performed by Google support engineers on their GCP project. Which service provides near-real-time logs of such access?

Accepted Answer

Access Transparency. Access Transparency provides logs when Google personnel access customer content (e.g., support cases, internal troubleshooting). These logs are near-real-time and can be viewed in Cloud Logging. Audit Logs (Cloud Audit Logs) record user API calls, not Google admin access.

Answer

Cloud Audit Logs

Answer

Cloud DLP

Answer

VPC Flow Logs

Question 6

Which Cloud KMS key purpose should be used to encrypt and decrypt data directly?

Accepted Answer

ENCRYPT_DECRYPT. The ENCRYPT_DECRYPT purpose is for symmetric encryption/decryption. ASYMMETRIC_SIGN is for digital signing, ASYMMETRIC_DECRYPT is for asymmetric decryption (e.g., using RSA), and MAC is for message authentication codes.

Answer

ASYMMETRIC_DECRYPT

Answer

ASYMMETRIC_SIGN

Answer

MAC

Question 7

An engineer needs to schedule automatic rotation of a symmetric key in Cloud KMS every 30 days. The key is currently enabled. What should they do?

Accepted Answer

Set the rotation period on the key via 'gcloud kms keys update'. Cloud KMS supports automatic rotation by setting a rotation period on the key. The key must have purpose ENCRYPT_DECRYPT (symmetric). The rotation period can be set in seconds (e.g., 2592000 for 30 days). Manual rotation is also possible but not automatic.

Answer

Automatic rotation is not supported for symmetric keys

Answer

Set a rotation period via 'gcloud kms keyrings create'

Answer

Manually create a new key version every 30 days using 'gcloud kms keys versions create'

Question 8

A company uses Cloud HSM to protect their cryptographic keys. They need to ensure that the key material never leaves the HSM. Which key purpose is supported by Cloud HSM keys?

Accepted Answer

All key purposes (ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, MAC). Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. HSM keys can have purposes ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, and MAC. The key material remains inside the HSM cluster and is never exposed to the customer. Software keys (software-backed) are stored in Cloud KMS but not in HSM.

Answer

Only symmetric ENCRYPT_DECRYPT

Answer

Only MAC purpose

Answer

Only asymmetric purposes

Question 9

A data engineer wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII). Which resource should they create to run this scan?

Accepted Answer

Create a DlpJob. Cloud DLP uses 'DlpJob' or 'InspectJob' to scan data. A 'DlpJob' can be created to inspect content in Cloud Storage, BigQuery, or Datastore. A job trigger can schedule scans, but the scan itself is a job. 'DeidentifyTemplate' and 'InspectTemplate' are configuration templates, not the scan execution.

Answer

Create an InspectTemplate

Answer

Create a JobTrigger

Answer

Create a DeidentifyTemplate

Question 10

An organization needs to de-identify a BigQuery column containing US Social Security Numbers (SSNs) by replacing them with a consistent token that can be reversed if needed. Which Cloud DLP de-identification transform should they use?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace sensitive data with a token that preserves the original format (e.g., 9 digits) and is reversible with the same key. BucketingConfig replaces with a range, MaskingConfig masks characters, and DateShiftConfig shifts dates.

Answer

BucketingConfig

Answer

MaskingConfig

Answer

DateShiftConfig

Question 11

A security team wants to automatically rotate a database password stored in Secret Manager every 60 days and notify the operations team when a new version is created. Which approach should they use?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications; use a Cloud Function to generate new password. Secret Manager supports automatic rotation with a Pub/Sub topic. You can set a rotation period (e.g., 60 days) and a Pub/Sub topic for notifications. A Cloud Function can listen to the topic and update the password. Secret Manager can also call a user-provided Cloud Function to generate the new secret version.

Answer

Use Cloud Scheduler to call Secret Manager API to add a new version

Answer

Use Cloud KMS key rotation to rotate the secret

Answer

Manually update the secret every 60 days

Question 12

What is the default grace period before Cloud KMS permanently destroys a key version that has been scheduled for destruction?

Accepted Answer

24 hours. When a key version is disabled and scheduled for destruction, there is a 24-hour pending destruction grace period by default. During this time, the key can be restored. After 24 hours, the key version is permanently destroyed.

Answer

7 days

Answer

Immediate destruction with no grace period

Answer

30 days

Question 13

A company is subject to ITAR regulations and needs to ensure that all data stored in GCP remains within the United States. They also require FIPS 140-2 Level 3 validation for encryption keys. Which two services should they use together to meet these requirements? (Choose 2)

Accepted Answer

Cloud HSM. Assured Workloads provides compliance controls for ITAR (among others) and can enforce data residency within the US. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for encryption keys. Together they satisfy both requirements.

Answer

Cloud KMS with software keys

Answer

Cloud DLP

Answer

Secret Manager

Question 14

A security engineer needs to enforce column-level masking on a BigQuery table such that: (1) users with role 'data_analyst' see masked values, (2) users with role 'data_scientist' see plaintext values, and (3) the masking is applied automatically without modifying the underlying table. Which three components must they configure? (Choose 3)

Accepted Answer

IAM roles (e.g., roles/bigquery.maskedReader). BigQuery column-level security uses: a Data Catalog taxonomy to define policy tags, a BigQuery Data Policy that specifies masking rules (e.g., hash, nullify) associated with the policy tag, and IAM roles (e.g., BigQuery Masked Reader) to grant access to masked data. The taxonomy contains the policy tags, the data policy defines the masking rule, and IAM controls who sees masked vs. plaintext.

Answer

Cloud KMS key for column encryption

Answer

Cloud DLP de-identification job

Question 15

An organization stores sensitive data in Cloud Storage and wants to use Cloud DLP to automatically scan new objects for PII as they are uploaded. Which two resources are needed? (Choose 2)

Accepted Answer

Cloud Storage Pub/Sub notifications. To scan objects automatically upon upload, you need a Cloud DLP job trigger that listens to Pub/Sub notifications from the storage bucket. The bucket must be configured to send Pub/Sub notifications for new objects. The job trigger will create inspect jobs when new objects are added.

Answer

Cloud Scheduler

Answer

Cloud Functions

Answer

Cloud DLP InspectTemplate