PCSE Ensuring Data Protection Practice Test 5 — 15 Questions

Question 1

An organization stores sensitive data in Cloud Storage and wants to use Cloud DLP to automatically scan new objects for PII as they are uploaded. Which two resources are needed? (Choose 2)

Accepted Answer

Cloud Storage Pub/Sub notifications. To scan objects automatically upon upload, you need a Cloud DLP job trigger that listens to Pub/Sub notifications from the storage bucket. The bucket must be configured to send Pub/Sub notifications for new objects. The job trigger will create inspect jobs when new objects are added.

Answer

Cloud Scheduler

Answer

Cloud Functions

Answer

Cloud DLP InspectTemplate

Question 2

An organization wants to ensure that all new resources created in Google Cloud are restricted to a specific set of regions to meet data residency requirements. Which policy should they use?

Accepted Answer

Configure the `gcp.resourceLocations` organization policy constraint. The org policy constraint `gcp.resourceLocations` restricts resource creation to the specified locations. This is the correct method to enforce data residency for resources globally.

Answer

Define a service perimeter using VPC Service Controls

Answer

Use IAM conditions to deny access outside approved regions

Answer

Enable Data Residency in Cloud Console settings

Question 3

A security engineer needs to automatically rotate a database password stored in Secret Manager every 60 days. Which approach meets this requirement with minimal operational overhead?

Accepted Answer

Set the rotation period in Secret Manager to 60 days and configure a Pub/Sub topic to trigger a Cloud Function that generates a new password. Secret Manager supports automatic rotation with a specified rotation period and Pub/Sub notifications. A Cloud Function can listen for the notification and generate a new password, updating the secret version.

Answer

Set the secret's `next_rotation_time` to 60 days from now; no further action needed

Answer

Enable automatic rotation with a 60-day period in Cloud KMS, which will automatically update the secret

Answer

Use a cron job on Compute Engine to update the secret every 60 days

Question 4

A financial services company must encrypt data at rest in Cloud Storage using keys that are generated and stored on-premises, and Google must never have access to the key material. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). CSEK (Customer-Supplied Encryption Keys) allows you to provide your own keys with each API call, and Google does not store them. This meets the requirement that Google never has access to key material.

Answer

Cloud External Key Manager (EKM) with a key management partner

Answer

Default Google-managed encryption (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS

Question 5

A company is using Cloud DLP to inspect a BigQuery table containing customer PII. They want to redact all credit card numbers found in a column by replacing them with a token that preserves the format (e.g., last 4 digits visible). Which de-identification transform should they use?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig performs format-preserving encryption (FPE), which can replace a value with a token that retains the format, such as last 4 digits visible.

Answer

MaskingConfig with a masking character

Answer

DateShiftConfig

Answer

BucketingConfig

Question 6

An organization needs to store API keys for external services. Which Google Cloud service is designed for secure storage of secrets such as API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Secret Manager is specifically designed for storing secrets like API keys, passwords, and certificates, with versioning, IAM access control, and rotation support.

Answer

Cloud KMS

Answer

Cloud Datastore

Answer

Cloud HSM

Question 7

A company wants to enforce that all Compute Engine disk encryption uses keys managed by their own HSM on-premises, with keys provided per API call. Which encryption type should they choose when creating a persistent disk?

Accepted Answer

Customer-supplied encryption (CSEK). CSEK (Customer-Supplied Encryption Keys) allows you to provide your own key with each API call, and Google never stores the key. This is appropriate for on-premises HSM integration.

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM-backed keys

Answer

Customer-managed encryption (CMEK) with Cloud KMS

Question 8

A security engineer notices that a Cloud KMS key was accidentally deleted. The key had a pending destruction period of 24 hours. What is the maximum time window to recover the key after the deletion request?

Accepted Answer

24 hours. When a key version is destroyed, it enters a 24-hour pending destruction period. During this time, it can be restored. After 24 hours, destruction is permanent and irreversible.

Answer

30 days

Answer

7 days

Answer

Immediately after deletion it cannot be recovered

Question 9

An organization needs to audit when Google administrators access their customer content stored in GCP. Which service provides near-real-time logs of such access?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs when Google staff access customer content, offering visibility into administrative actions.

Answer

VPC Flow Logs

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Question 10

A data engineer wants to classify columns in BigQuery containing sensitive data like email addresses and apply data masking so that users see only masked values (e.g., 'j***@example.com'). Which feature should they use?

Accepted Answer

BigQuery column-level security with policy tags and data masking rules. BigQuery column-level security with policy tags allows classification, and BigQuery Data Policy with data masking rules (like email masking) applies dynamic masking at query time.

Answer

Cloud DLP inspection jobs

Answer

Cloud IAM roles for BigQuery

Answer

View with SQL masking

Question 11

A company using Cloud KMS wants to automatically rotate a symmetric encryption key every 90 days. What is the correct way to configure this?

Accepted Answer

Set the rotation period on the cryptographic key to 90 days. Cloud KMS supports automatic rotation by setting a rotation period on the key. The key's primary version will be rotated automatically at the specified interval.

Answer

Set the key purpose to ASYMMETRIC_SIGN for automatic rotation

Answer

Set the rotation period to 90 days when creating the key ring

Answer

Use Cloud Scheduler to call `cloudkms.rotateKey` every 90 days

Question 12

A healthcare organization uses Cloud DLP to scan a Cloud Storage bucket containing medical records. They want to inspect for sensitive data such as patient names and SSNs, but only on new objects added after a certain date. Which DLP configuration should they use?

Accepted Answer

Use Cloud Functions to trigger DLP inspection on new object creation events. The correct approach is to use Cloud Functions triggered by Cloud Storage object finalize events. When a new object is added, the Cloud Function invokes the Cloud DLP API to inspect only that object. This provides real-time scanning of new data without rescanning the entire bucket. Option D is incorrect because DLP job triggers do not support a `time_filter` parameter to limit scans to objects after a specific date; they scan the entire bucket or a defined subset on a schedule.

Answer

Create a DLP job trigger with a schedule that runs daily and scans the entire bucket

Answer

Use BigQuery to query the bucket and then scan the results with DLP

Answer

Create a DLP job trigger with a schedule and set `cloud_storage_options.time_filter` to scan only objects after a date

Question 13

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

Accepted Answer

Cloud HSM. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

Answer

Secret Manager

Answer

Cloud KMS with software-backed keys

Answer

Cloud External Key Manager

Question 14

A company needs to enforce data residency in the European Union for all GCP resources. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Assured Workloads with an EU data boundary. To enforce EU data residency, an organization policy constraint `gcp.resourceLocations` can restrict allowed locations to EU regions. Additionally, Assured Workloads can provide regulatory compliance for EU data boundary. VPC Service Controls prevent data exfiltration but do not enforce residency. Audit Logs and IAM do not restrict locations.

Answer

Create a VPC Service Perimeter that only allows access from EU regions

Answer

Set IAM policies to deny access to non-EU regions

Answer

Enable Cloud Audit Logs to monitor resource creation outside EU

Question 15

A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)

Accepted Answer

Ensure that the key's destruction policy does not automatically destroy versions before 6 months. To meet the requirements: 1) Set rotation period to 30 days on the key; 2) Do not destroy old key versions until after 6 months; 3) The default destruction policy does not automatically destroy old versions, so they remain available. Setting a primary version is not required for rotation, and disabling rotation is contrary.

Answer

Manually rotate the key every 30 days using a Cloud Function

Answer

Configure the key's `next_rotation_time` to start rotation immediately