PCSE Ensuring Data Protection Practice Test 5 — 15 Questions

Question 1

A healthcare company uses Cloud DLP to de-identify patient data in a BigQuery table. They need to replace all patient names with a consistent surrogate value so that the same name always maps to the same surrogate, but the mapping cannot be reversed without a separate secret. Which Cloud DLP transformation should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CryptoDeterministicConfig with a surrogate and a separate mapping secret. The requirement is for a consistent surrogate that cannot be reversed without a separate secret. CryptoDeterministicConfig with a surrogate and a separate mapping secret uses deterministic encryption to ensure the same input always produces the same surrogate, and the mapping secret (a KMS key) is required to reverse the process. This provides consistency and non-reversibility without a separate secret store, unlike other options that are either reversible or not consistent.

Answer

CryptoDeterministicConfig with a KMS-wrapped key

Answer

CryptoReplaceFfxFpeConfig with a KMS-wrapped key

Answer

CryptoReplace with a KMS-wrapped key

Question 2

A company uses Cloud DLP to inspect and de-identify sensitive data in a Cloud Storage bucket. They want to use the de-identification transformation that replaces sensitive values with a surrogate value that preserves the original data's format and length, and they also want to ensure that the same input value always maps to the same surrogate value across multiple runs. Which two Cloud DLP de-identification transformations should they use? (Choose two.)

Accepted Answer

CryptoDeterministicConfig. CryptoReplaceFfxFpeConfig is specifically designed for format-preserving encryption, maintaining the original format and length. CryptoDeterministicConfig provides deterministic encryption, ensuring the same input maps to the same surrogate across runs. Together, they can be used to achieve both format preservation and consistency. However, note that CryptoDeterministicConfig alone does not preserve format, so it must be used with a format-preserving surrogate or in combination with FFX. In practice, CryptoReplaceFfxFpeConfig is the primary transform for format-preserving deterministic encryption.

Answer

DateShiftConfig

Answer

CharacterMaskConfig

Answer

ReplaceConfig

Question 3

A multinational bank stores regulated customer data in a Cloud Storage bucket. The security team must ensure that any object written to the bucket is encrypted before it leaves the application, that Google Cloud never sees plaintext object contents, and that the keys can be rotated by the bank without re-uploading objects. Which approach meets all of these requirements?

Accepted Answer

Encrypt objects client-side with the bank's own key before upload, storing ciphertext in the bucket. Only client-side encryption keeps plaintext entirely within the bank's application boundary; the platform receives and stores ciphertext. Because the bank owns the encryption keys, it can rotate them and re-encrypt stored objects independently. CMEK and CSEK both involve server-side encryption of uploaded bytes, and Cloud DLP de-identification is a data-transform privacy tool, not full-object encryption under customer-controlled keys.

Answer

Use customer-supplied encryption keys (CSEK) with AES-256 keys supplied on each request

Answer

Enable CMEK on the bucket using a Cloud KMS key in the bank's project

Answer

Apply a Cloud DLP de-identification template to the bucket to tokenize sensitive fields on write

Question 4

Your organization stores sensitive customer records in Cloud Storage. A security policy requires that all data be encrypted with a customer-managed encryption key (CMEK) and that you retain full control over the key's lifecycle. You have created a Cloud KMS key ring and a symmetric key in the global location. You need to configure the bucket so that every object is encrypted with this key by default. What should you do?

Accepted Answer

Set the bucket's default KMS key to the Cloud KMS key using the `gsutil kms encryption` command or the Cloud Storage JSON API.. Setting a default KMS key on a Cloud Storage bucket ensures that all objects written to the bucket are encrypted with that customer-managed key. The key must reside in the same location as the bucket, and the Cloud Storage service account requires the appropriate IAM role on the key. This approach provides persistent control over encryption without requiring per-object key specification.

Answer

Create a Cloud KMS key in the same region as the bucket and assign the `roles/cloudkms.cryptoKeyEncrypterDecrypter` role to all users who will upload objects.

Answer

Enable uniform bucket-level access and then apply an organization policy constraint that enforces CMEK usage for all Cloud Storage buckets.

Answer

Enable the Cloud Storage default event-based hold on the bucket and specify the KMS key in the bucket's retention policy.

Question 5

A security team is using Cloud DLP to inspect a large dataset in BigQuery for sensitive information. They want to minimize the cost of the inspection while ensuring that all rows are scanned. The dataset contains a column with free-form text that may contain credit card numbers. They decide to use sampling to reduce the number of rows scanned. Which sampling method should they use to ensure that the sample is representative and that the inspection results are statistically valid?

Accepted Answer

Use the 'sampling_method' parameter set to 'RANDOM_START' with a limit of 100000 rows.. The RANDOM_START sampling method with a high limit allows scanning a large contiguous block of rows starting from a random point. This increases coverage while reducing cost compared to a full scan. It is a supported method in Cloud DLP and is suitable for large datasets where a full scan is expensive. The other options either use unsupported methods or insufficient limits.

Answer

Use the 'sampling_method' parameter set to 'STRATIFIED' with a limit of 1000 rows.

Answer

Use a random sample of 10% of the rows.

Answer

Use the 'sampling_method' parameter set to 'RANDOM_START' with a limit of 1000 rows.

Question 6

A financial services firm uses BigQuery to store transactional data. They want to ensure that only users with the role 'Data Analyst' can view the 'account_number' column, while other users can see all other columns but not 'account_number'. They also need to prevent even project owners from accessing the column unless explicitly granted. Which BigQuery feature should they implement?

Accepted Answer

Column-level security using policy tags. Column-level security with policy tags is the correct approach because it enables fine-grained access control at the column level. By associating a policy tag with the 'account_number' column and granting the fine-grained reader role to the Data Analyst group, you ensure that only authorized users can see that column. Other users, including project owners, are denied access unless explicitly granted, satisfying the requirement to restrict even project owners.

Answer

BigQuery data masking with Cloud DLP

Answer

Authorized views

Answer

Row-level security using filter expressions

Question 7

A financial institution uses Cloud KMS to manage encryption keys for data at rest in BigQuery and Cloud Storage. They require that all data be encrypted with customer-managed encryption keys (CMEK) and that key usage be auditable. They also need to ensure that if a key is disabled, data becomes inaccessible. Which two configurations should they implement to meet these requirements? (Choose two.)

Accepted Answer

Create a Cloud KMS key ring and key in the same region as the data, and grant the BigQuery and Cloud Storage service accounts the cloudkms.cryptoKeyEncrypterDecrypter role on the key.. To meet the requirements, the financial institution must create a CMEK in the same region as the data and grant the BigQuery and Cloud Storage service accounts the cryptoKeyEncrypterDecrypter role. This ensures data is encrypted with the CMEK and that disabling the key makes data inaccessible. Additionally, enabling Cloud Audit Logs for Cloud KMS and exporting them provides the necessary audit trail for key usage. Together, these configurations satisfy both encryption and auditability requirements.

Answer

Use Cloud External Key Manager (Cloud EKM) to store keys in a third-party key management system.

Answer

Set the key rotation period to 90 days and enable automatic rotation.

Answer

Grant the BigQuery and Cloud Storage service accounts the cloudkms.cryptoKeyEncrypterDecrypter role on the key.

Question 8

A healthcare company stores patient data in Cloud Storage and BigQuery. They need to implement a data loss prevention (DLP) strategy that (1) discovers sensitive data across both services, (2) de-identifies sensitive data in near real-time as it is written to BigQuery, and (3) prevents sensitive data from being stored in Cloud Storage buckets that are publicly accessible. Which two Google Cloud services or features should they use? (Choose two.)

Accepted Answer

Cloud DLP de-identification templates integrated with BigQuery using the DLP API in a streaming pipeline.. To meet the three requirements, use Cloud DLP discovery to scan and classify sensitive data in Cloud Storage and BigQuery, and use Cloud DLP de-identification templates integrated with BigQuery via the DLP API in a streaming pipeline to de-identify data in near real-time. Public access prevention on buckets can address the third requirement, but the question asks for two services/features that together cover discovery and real-time de-identification; those are discovery and de-identification templates. The other options either do not address the core needs or are redundant.

Answer

VPC Service Controls perimeter around the Cloud Storage and BigQuery resources.

Answer

Cloud Storage bucket IAM policies with public access prevention enforced.

Answer

Cloud DLP inspection templates scheduled to run on BigQuery and Cloud Storage.

Question 9

A security engineer needs to ensure that data stored in Cloud Storage buckets is protected against accidental deletion and that all access to the data is logged. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable Object Versioning on the bucket.. Object Versioning protects against accidental deletion by retaining object versions, and Cloud Audit Logs for data access provide a record of all access. Together, they meet the requirements. The other options either do not address logging or do not protect against deletion in a way that allows recovery.

Answer

Enable Bucket Lock.

Answer

Configure a retention policy on the bucket.

Answer

Enable Uniform Bucket-Level Access.

Question 10

You are configuring Cloud KMS for a project that handles regulated data. You need to ensure that key material is generated and stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3, and that key usage is automatically logged for audit. (Choose two.)

Accepted Answer

Use a key ring in a region that supports HSM.. To meet the HSM requirement, you must create the key with protection level HSM and ensure the key ring is in a region that supports HSM. Cloud KMS automatically logs key usage to Cloud Audit Logs, so no separate logging configuration is needed. The other options either do not provide HSM protection or are unnecessary for meeting the requirements.

Answer

Grant the Cloud KMS service account the Cloud KMS Admin role.

Answer

Enable Cloud Audit Logs for Cloud KMS.

Answer

Create a key with protection level SOFTWARE.

Question 11

A security team needs to ensure that all data written to a BigQuery dataset is encrypted with a key that they control and can revoke. They also need to ensure that the key is automatically rotated every 180 days. They have created a Cloud KMS key ring and a symmetric key with purpose ENCRYPT_DECRYPT. What should they do next to enforce encryption of the BigQuery dataset with this key?

Accepted Answer

Set the default encryption key on the BigQuery dataset to the Cloud KMS key.. To enforce that all data in a BigQuery dataset is encrypted with a customer-managed key, you set the dataset's default encryption key to the Cloud KMS key. This ensures that any new table created in the dataset automatically uses that key. The BigQuery service account must also have the encrypter/decrypter role, but that alone does not enforce the key; the dataset default is the enforcement mechanism.

Answer

Create a new table with the Cloud KMS key specified in the table options.

Answer

Enable Customer-Managed Encryption Keys (CMEK) in the BigQuery API settings.

Answer

Grant the BigQuery service account the cloudkms.cryptoKeyEncrypterDecrypter role on the key.

Question 12

A financial institution uses Cloud DLP to inspect a BigQuery table containing customer records. They need to replace all email addresses with a deterministic token that can be re-identified later using a separate mapping stored in Cloud KMS. The token must preserve the format of the original email address so that existing applications can continue to process the data without schema changes. Which Cloud DLP transformation should they use?

Accepted Answer

CryptoReplaceFfxFpeConfig with an alphabet that includes alphanumeric characters and the @ symbol.. CryptoReplaceFfxFpeConfig uses format-preserving encryption to produce a token that matches the original's length and character set. By defining an alphabet that includes the @ symbol, the output can look like an email address. It is deterministic with the same key and tweak, enabling re-identification via the key stored in Cloud KMS, and it preserves format for existing applications.

Answer

CryptoDeterministicConfig with a surrogate type of EMAIL_ADDRESS.

Answer

CharacterMaskConfig with a masking character of '*' and a fixed number of characters to mask.

Answer

CryptoReplaceConfig with a surrogate type of EMAIL_ADDRESS.

Question 13

A retail company uses Cloud DLP to scan a BigQuery dataset containing customer PII. They need to de-identify the data before sharing it with an analytics team. The de-identification must replace email addresses with a consistent token so that the same email always maps to the same token, and it must also redact any credit card numbers entirely. Which two Cloud DLP transformations should they apply? (Choose two.)

Accepted Answer

CryptoReplaceFfxFpeConfig with an encryption key and a surrogate alphabet.. CryptoReplaceFfxFpeConfig provides format-preserving encryption with a consistent key, ensuring the same email always maps to the same token. RedactConfig removes credit card numbers entirely. Together, they meet the requirements for consistent tokenization and complete redaction.

Answer

CharacterMaskConfig to mask email addresses with asterisks.

Answer

CryptoDeterministicConfig to encrypt email addresses deterministically.

Answer

DateShiftConfig to shift dates in the dataset.

Question 14

A security team is implementing data loss prevention for a Google Workspace environment. They need to prevent users from sharing files containing credit card numbers externally and also monitor for any attempts to do so. Which two Google Cloud services should they use? (Choose two.)

Accepted Answer

Google Workspace Admin console audit logs and alert center to monitor sharing attempts. Cloud DLP is essential for scanning and detecting credit card numbers in Google Workspace files and can enforce policies to block external sharing. The Google Workspace Admin console audit logs and Alert Center provide monitoring and alerting on sharing activities. Together, they prevent and monitor data exfiltration. The other services do not apply to Google Workspace file sharing or lack the necessary DLP capabilities.

Answer

VPC Service Controls to create a perimeter around Google Workspace

Answer

Security Command Center to monitor for data exfiltration events

Answer

Cloud Identity-Aware Proxy (IAP) to control access to Google Workspace

Question 15

A financial services firm uses Cloud DLP to inspect and de-identify sensitive data in a Cloud Storage bucket. They need to replace each detected credit card number with a surrogate value that is consistently the same for the same input, so that analytics can be performed across records without revealing the original numbers. The surrogate must be irreversible. Which Cloud DLP transformation should they use?

Accepted Answer

CryptoDeterministicConfig with a CryptoKey.. The requirement is for a consistent, irreversible surrogate that maps each credit card number to the same replacement value across records. CryptoDeterministicConfig in Cloud DLP uses deterministic encryption with a Cloud KMS key to produce the same ciphertext for the same input, enabling consistent pseudonymization while preventing recovery of the original value without the key.

Answer

CryptoReplaceFfxFpeConfig with a surrogate alphabet and a KMS-wrapped key.

Answer

ReplaceConfig with a fixed string such as '[REDACTED]'.

Answer

CryptoHashConfig with a CryptoKey.