PCSE Ensuring Data Protection Practice Test 4 — 15 Questions

Question 1

A healthcare company stores patient records in Cloud Storage. They need to prevent any data from being written to a bucket if it contains unencrypted protected health information (PHI). They also want to enforce this policy across all projects in the organization. Which Google Cloud service should they use to implement this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Data Loss Prevention (DLP) with a Cloud Storage bucket policy and integrated enforcement. Cloud DLP is designed to discover and protect sensitive data. When integrated with Cloud Storage, it can automatically scan new objects and take action based on findings, such as preventing the storage of unencrypted PHI. This provides the content-aware enforcement needed, unlike access control or perimeter mechanisms that do not inspect data content.

Answer

Cloud Data Loss Prevention (DLP) with inspection and de-identification templates

Answer

Cloud Storage bucket IAM policies with conditions based on resource attributes

Answer

VPC Service Controls with a perimeter around the Cloud Storage API

Question 2

A financial company uses BigQuery to store transaction data. They need to ensure that only users with the role 'data_analyst' can view the 'account_number' column, while other users can see all other columns. They also want to prevent data_analysts from exporting the column to Cloud Storage. What should they implement?

Accepted Answer

Column-level security with policy tags and a VPC Service Controls perimeter.. Column-level security with policy tags enables granular access control, allowing only authorized users to see the account_number column. VPC Service Controls can prevent data exfiltration by restricting BigQuery's ability to export data to Cloud Storage. Together, they satisfy both the access and prevention requirements. Other options either do not provide column-level control or do not prevent export.

Answer

Authorized views and Cloud DLP de-identification.

Answer

BigQuery row-level security and Cloud Audit Logs.

Answer

IAM basic roles and a Cloud Storage bucket lock.

Question 3

Your organization stores sensitive customer records in Cloud Storage. A data governance policy requires that all objects be encrypted with a customer-managed encryption key (CMEK) so that access can be revoked by disabling the key. You need to enforce this requirement for a specific bucket so that any upload attempt without a CMEK fails immediately. What should you do?

Accepted Answer

Apply a bucket-level policy using the gcloud storage buckets update command with the --default-encryption-key flag and remove permissions to upload without a key.. Enforcing CMEK on a bucket requires setting a default KMS key and ensuring that the Cloud Storage service account has permission to use it. Additionally, you must remove any IAM permissions that would allow uploading objects without a CMEK, such as the storage.objectCreator role without conditions. This combination ensures that every object is encrypted with the customer-managed key and that revocation is possible by disabling the key.

Answer

Enable uniform bucket-level access and grant only the roles/storage.objectCreator role to users who need to upload objects.

Answer

Create an Organization Policy constraint of type storage.requireCmeK and apply it to the project containing the bucket.

Answer

Set the bucket's default KMS key to a Cloud KMS key and grant the Cloud Storage service account the cloudkms.cryptoKeyEncrypterDecrypter role.

Question 4

A security engineer is investigating why an application running on Compute Engine is unable to decrypt data using a Cloud KMS symmetric key. The Cloud Audit Logs show that the service account used by the VM has the roles/cloudkms.cryptoKeyDecrypter IAM role on the key. However, the decryption attempts are failing with a PERMISSION_DENIED error related to the Cloud KMS API. Which additional IAM permission is required for the service account to successfully call the Cloud KMS API?

Accepted Answer

roles/cloudkms.cryptoKeyEncrypterDecrypter. The service account already has the decrypter role, but the PERMISSION_DENIED error related to the Cloud KMS API indicates that the required permission cloudkms.cryptoKeyVersions.useToDecrypt might not be effectively granted, or the API is not enabled. The roles/cloudkms.cryptoKeyEncrypterDecrypter role includes this permission and also allows encryption, which could be needed for other operations. This role is the correct choice to ensure the service account can call the Cloud KMS API successfully.

Answer

roles/cloudkms.viewer

Answer

roles/cloudkms.publicKeyViewer

Answer

roles/cloudkms.admin

Question 5

A healthcare analytics company stores patient records in Cloud Storage buckets. A security engineer must ensure that data is encrypted at rest with keys that the company fully controls, including the ability to revoke access by disabling the key, and that the keys are stored in a FIPS 140-2 Level 3 validated HSM. Which Google Cloud service should they use?

Accepted Answer

Cloud KMS with a key ring that uses HSM protection level. The requirement for FIPS 140-2 Level 3 validated HSM-backed keys with customer control points to Cloud KMS HSM keys. Cloud KMS HSM keys are stored in hardware security modules, support disabling or destroying key versions to revoke access, and integrate with Cloud Storage for encryption at rest. Software keys, EKM, and CSEKs do not meet the hardware validation and control requirements in this scenario.

Answer

Customer-supplied encryption keys (CSEK) managed in Secret Manager

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud Key Management Service (Cloud KMS) with a software key ring

Question 6

A healthcare analytics company stores protected health information (PHI) in Cloud Storage buckets. They must ensure that any data exfiltration attempt via the public internet is blocked, while still allowing access from their on-premises data center through a dedicated interconnect. Which Google Cloud control should they implement to meet this requirement?

Accepted Answer

VPC Service Controls perimeter with an access level that includes only the on-premises network's CIDR range, and no access level for public internet.. VPC Service Controls are designed to mitigate data exfiltration by defining a security perimeter around Google Cloud services. By setting an access level that includes only the on-premises network's CIDR range, all other sources, including public internet, are denied access to the Cloud Storage bucket. This ensures that data cannot be exfiltrated via the public internet while still allowing legitimate access from the on-premises data center through the dedicated interconnect.

Answer

Cloud Storage bucket with Uniform Bucket-Level Access and a VPC Service Controls perimeter that includes the on-premises network via Cloud VPN.

Answer

Cloud Storage bucket with a firewall rule that allows traffic only from the on-premises IP range and denies all other traffic.

Answer

VPC Service Controls perimeter around the Cloud Storage project, with an access level that allows only the on-premises network's public IP range.

Question 7

A multinational corporation uses Cloud Storage to store sensitive data across multiple regions. They need to ensure that data is encrypted with a key that is automatically rotated every 90 days, and that they can prove to auditors that the key rotation occurred. Which Cloud KMS configuration should they use?

Accepted Answer

Create a global key ring with a symmetric key and set the rotation period to 90 days. Enable Cloud Audit Logs for key rotation.. A global key ring with a symmetric key and a 90-day rotation period provides global availability and automatic rotation. Cloud Audit Logs capture key rotation events, which auditors can review. Other options either use incorrect key types, lack global availability, or do not provide the necessary audit trail.

Answer

Create a key ring in each region where data is stored, set rotation to 90 days, and use Cloud Asset Inventory to track rotations.

Answer

Create a key ring in a single region and set the rotation period to 90 days. Use Cloud Audit Logs to track key rotation events.

Answer

Create an asymmetric key in a global key ring and set the rotation period to 90 days. Use Cloud Logging to export logs.

Question 8

A multinational corporation uses Google Cloud to store data across multiple regions. They need to ensure that data encrypted with Cloud KMS keys cannot be decrypted if the key is moved to a different region, and they want to enforce this at the infrastructure level. Which Cloud KMS feature should they use?

Accepted Answer

Cloud KMS with VPC Service Controls and regional access levels. To enforce that a Cloud KMS key cannot be used for decryption outside a specific region, you need a mechanism that restricts API calls based on the origin region. VPC Service Controls with access levels can do this by allowing access only from specified regions. This provides the infrastructure-level enforcement required, ensuring that even if the key is technically accessible, decryption requests from other regions are blocked.

Answer

Cloud KMS key rings with regional locations

Answer

Cloud KMS with customer-managed encryption keys (CMEK) and regional IAM policies

Answer

Cloud KMS key versions with regional replication

Question 9

A retail company keeps payment card data in a Cloud SQL for PostgreSQL instance. Compliance requires that the data be encrypted at rest with keys the company controls and can revoke, and the security team wants to be able to disable all access to the database files immediately if a key is suspected compromised. Which configuration should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) in Cloud KMS applied to the Cloud SQL instance. CMEK in Cloud KMS gives the organization ownership of the key that protects the Cloud SQL instance. Disabling or destroying that key version prevents Google Cloud from decrypting the instance, which is the fastest way to revoke access to the database files. Google-managed keys, client-side column encryption, and Cloud EKM each fail the requirement for customer-controlled, instance-level revocation.

Answer

Cloud External Key Manager backed by a key held in an on-premises HSM

Answer

Client-side encryption of individual column values before inserting rows into Cloud SQL

Answer

Google-managed encryption keys with default Cloud SQL encryption

Question 10

A startup wants to store API keys for third-party services used by its applications running on Compute Engine. The keys must be encrypted at rest and automatically rotated every 60 days. The startup has minimal operational overhead and wants a fully managed solution. What should they use?

Accepted Answer

Secret Manager with a secret containing the API keys and an automatic rotation schedule of 60 days.. Secret Manager is the correct choice because it is purpose-built for storing and managing secrets, with built-in encryption and support for automatic rotation. It minimizes operational overhead by handling versioning and access control. The other options either misuse services or require additional management.

Answer

Cloud KMS with a symmetric key and automatic rotation set to 60 days, storing the encrypted keys in a Cloud Storage bucket.

Answer

Compute Engine metadata server with the API keys stored as custom metadata, protected by IAM.

Answer

Cloud DLP to encrypt the API keys and store them in a BigQuery table with column-level access control.

Question 11

A healthcare organization stores patient records in Cloud Storage. They must ensure that data is encrypted at rest with keys that they control and that all access to the data is logged for audit. They also need to prevent Google personnel from accessing the data. Which combination of Google Cloud services should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) with Cloud KMS and Cloud Audit Logs for data access.. Using CMEK with Cloud KMS gives the organization control over the encryption keys, including the ability to rotate and revoke them. Enabling Data Access audit logs for Cloud Storage records all access to the data, providing the necessary audit trail. While CMEK does not inherently prevent Google personnel from accessing data, it ensures that the organization controls the keys. For preventing Google access, additional measures like Cloud EKM or Access Transparency might be considered, but the question focuses on key control and audit logging.

Answer

Cloud External Key Manager (Cloud EKM) and Access Transparency logs.

Answer

Customer-supplied encryption keys (CSEK) and VPC Service Controls.

Answer

Google-managed encryption keys and Access Transparency logs.

Question 12

A retail company uses BigQuery to store customer transaction data. They need to ensure that only users with the role 'BigQuery Data Viewer' can see the data, and that they cannot export the data to Cloud Storage. Which Google Cloud feature should they use to enforce this?

Accepted Answer

BigQuery data egress controls using VPC Service Controls. VPC Service Controls are designed to mitigate data exfiltration risks by creating a perimeter around Google Cloud services. For BigQuery, you can define egress rules that deny access to Cloud Storage, effectively preventing export operations. The other options address access control within BigQuery but do not block the export action itself, which is a separate permission that can be restricted with VPC Service Controls.

Answer

BigQuery column-level security using policy tags

Answer

IAM deny policies on the BigQuery Data Viewer role

Answer

BigQuery row-level security using filter expressions

Question 13

A financial institution uses BigQuery to analyze sensitive customer data. They need to ensure that analysts can query the data but cannot see plaintext credit card numbers. The analysts should still be able to perform joins and aggregations on the credit card numbers. Which approach should they use?

Accepted Answer

Use BigQuery dynamic data masking with a masking rule that preserves the ability to join and aggregate.. BigQuery dynamic data masking allows analysts to query and perform joins and aggregations on sensitive columns while seeing masked values. The masking is enforced at query time based on IAM permissions, so authorized users can see the actual data. The other options either prevent joins/aggregations or replace data in a way that breaks exact matching.

Answer

Use BigQuery column-level security with policy tags to restrict access to the credit card column.

Answer

Use Cloud DLP to tokenize the credit card numbers using format-preserving encryption (FPE) before loading into BigQuery.

Answer

Use Cloud DLP to de-identify the credit card numbers using bucketing before loading into BigQuery.

Question 14

A security engineer is configuring a Cloud KMS key ring for a new application. They need to ensure that the key can be used to encrypt and decrypt data in Cloud Storage, and that the key material is automatically rotated every 90 days. They also want to be able to manually rotate the key if needed. Which two actions should they take? (Choose two.)

Accepted Answer

Set the key's rotation period to 90 days and enable automatic rotation.. To meet the requirements, the key must be symmetric with purpose ENCRYPT_DECRYPT, have automatic rotation enabled with a 90-day period, and the Cloud Storage service account must be granted the cloudkms.cryptoKeyEncrypterDecrypter role. Manual rotation remains possible at any time. The other options either use the wrong key purpose or rely on external scheduling instead of Cloud KMS's built-in rotation.

Answer

Set the key's purpose to ASYMMETRIC_DECRYPT.

Answer

Manually rotate the key by creating a new key version every 90 days using a cron job.

Answer

Create the key with purpose set to ASYMMETRIC_SIGN.

Question 15

A healthcare company stores patient records in Cloud Storage. They need to prevent any data from being written to a bucket if it contains unencrypted protected health information (PHI). They also want to enforce this policy across all projects in the organization. Which Google Cloud service should they use to implement this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the bucket's IAM policy to grant roles/storage.objectViewer to specific users, enable Uniform bucket-level access, and enable Cloud Audit Logs for data access.. Uniform bucket-level access disables object ACLs, ensuring that only IAM policies grant access and preventing public URLs. Granting roles/storage.objectViewer to specific users enforces least privilege for read access. Enabling Cloud Audit Logs for data access captures all object reads. Together, these features meet the requirements for access control, public access prevention, and audit logging.

Answer

Enable Cloud CDN on the bucket and configure IAM to allow only authenticated users, and use VPC Service Controls to restrict access.

Answer

Apply a Cloud DLP de-identification template to the bucket, and grant roles/storage.objectAdmin to all users in the organization.

Answer

Use object-level ACLs to grant READ permission to specific users, and enable Cloud Armor to block public access.