PCSE Ensuring Data Protection Practice Test 6 — 15 Questions

Question 1

Your company uses Cloud DLP to inspect a BigQuery dataset containing personally identifiable information (PII). You need to de-identify the data before sharing it with an analytics team. The analytics team requires that the de-identified data preserves the original data's format and length, and that the same input value always maps to the same output value across multiple runs. Which Cloud DLP transformation should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deterministic encryption using a Cloud KMS key and a surrogate.. Deterministic encryption in Cloud DLP uses a cryptographic key to map identical input values to identical output tokens, ensuring consistency across runs. It preserves the original data's format and length by substituting a surrogate value that matches the original data type. This is ideal for joining de-identified datasets or maintaining referential integrity without exposing sensitive data.

Answer

Date shifting with a custom range.

Answer

Format-preserving encryption (FPE) using a Cloud KMS key.

Answer

Crypto-based tokenization using a Cloud KMS key with format-preserving encryption.

Question 2

A company stores sensitive customer data in Cloud SQL for MySQL. They need to ensure that the data is encrypted at rest with keys they manage, and they need to be able to revoke access to the data by disabling the key. They also need to prove to auditors that all access to the keys is logged. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud KMS with CMEK for Cloud SQL, and Cloud Audit Logs for Cloud KMS.. To encrypt Cloud SQL data with customer-managed keys, you use Cloud KMS to create a key and configure the Cloud SQL instance to use that key (CMEK). Disabling the key revokes access to the data. To prove that all access to the keys is logged, you enable Cloud Audit Logs for Cloud KMS, which records all API calls. This combination satisfies the encryption, revocation, and audit requirements.

Answer

Cloud KMS with CMEK for Cloud SQL, and VPC Service Controls to log key usage.

Answer

Cloud EKM with CMEK for Cloud SQL, and Cloud Audit Logs for Cloud EKM.

Answer

Cloud HSM with CMEK for Cloud SQL, and Cloud Audit Logs for Cloud HSM.

Question 3

A financial institution uses BigQuery to analyze sensitive customer data. They need to ensure that only users with the role 'data_analyst' can query columns containing personally identifiable information (PII), while other users can query non-PII columns. They also want to mask PII values for users without the role. Which BigQuery feature should they use?

Accepted Answer

Column-level security with policy tags. Column-level security with policy tags is the correct feature. By tagging PII columns with a policy tag and granting the Fine-Grained Reader role to the 'data_analyst' role, you ensure that only those users can access the PII columns. Other users querying the table will receive an error if they try to access those columns. This provides the required role-based access control at the column level.

Answer

Row-level security with filter expressions

Answer

Cloud DLP de-identification with masking

Answer

BigQuery authorized views

Question 4

A security engineer needs to ensure that data stored in a Cloud Storage bucket is encrypted with a key that is automatically rotated every 90 days. The key must be managed by the organization, and they want to use Cloud KMS. Which key type should they create?

Accepted Answer

Symmetric key with automatic rotation. A symmetric Cloud KMS key with automatic rotation is the correct choice because it supports scheduled rotation of key versions. You can set the rotation period to 90 days, and Cloud KMS will automatically generate a new primary key version. The old versions are retained for decryption, so data encrypted with previous versions remains accessible. This provides the required security and operational simplicity.

Answer

Symmetric key with manual rotation

Answer

Asymmetric key with automatic rotation

Answer

Cloud HSM key with automatic rotation

Question 5

Your organization needs to ensure that data stored in Cloud Storage and BigQuery is protected from unauthorized access and exfiltration. You are evaluating Google Cloud services to implement data loss prevention (DLP) and access control. Which two Google Cloud services should you use to discover and classify sensitive data across both Cloud Storage and BigQuery? (Choose two.)

Accepted Answer

Sensitive Data Protection (Cloud DLP) integration with BigQuery and Cloud Storage. Cloud DLP and its evolution, Sensitive Data Protection, are the only Google Cloud services that natively discover and classify sensitive data in Cloud Storage and BigQuery. They scan data, identify sensitive content using infoType detectors, and produce findings that can drive remediation. Other services focus on data integration, asset metadata, or access control, but not content inspection.

Answer

Cloud Asset Inventory

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Cloud Data Fusion

Question 6

A security team is configuring Cloud DLP to de-identify sensitive data in a BigQuery table before sharing it with a partner. They want to use a transformation that replaces each sensitive value with a surrogate from a predefined dictionary, ensuring that the same input always maps to the same output. They also need to preserve the original data type (e.g., date, email) so that the partner's analytics tools can process the data correctly. Which two Cloud DLP transformations should they consider? (Choose two.)

Accepted Answer

CryptoDeterministicConfig with a surrogate type matching the infoType.. CryptoDeterministicConfig and ReplaceDictionaryConfig both provide deterministic replacement using surrogates. CryptoDeterministicConfig uses a cryptographic key to generate type-appropriate surrogates, while ReplaceDictionaryConfig uses a user-defined dictionary. Both preserve the original data type, ensuring compatibility with analytics tools. The other transformations either are not dictionary-based, not deterministic, or do not preserve data type.

Answer

CryptoReplaceFfxFpeConfig with an alphabet that matches the data type.

Answer

DateShiftConfig with a random date shift.

Answer

CharacterMaskConfig with a masking character that preserves the data type.

Question 7

A security team is configuring Cloud DLP to de-identify data in a BigQuery table. They need to replace detected email addresses with a format-preserving token that retains the domain but masks the local part, and they also need to replace detected phone numbers with a surrogate that is consistently the same for the same input. Which two Cloud DLP transformations should they use? (Choose two.)

Accepted Answer

ReplaceConfig with a regex to replace the local part of email addresses with a fixed string, preserving the domain.. To retain the domain while masking the local part of email addresses, ReplaceConfig with a regex is appropriate because it can target only the local part and replace it with a fixed string. For consistent replacement of phone numbers, CryptoDeterministicConfig provides a deterministic surrogate that is the same for the same input and is irreversible without the key. Together, these two transformations meet the requirements.

Answer

DateShiftConfig for phone numbers, using a random shift.

Answer

CryptoHashConfig for phone numbers, using a CryptoKey.

Answer

CryptoReplaceFfxFpeConfig for email addresses, using a surrogate alphabet that includes '@' and '.'.

Question 8

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They need to rotate the key automatically every 30 days. What must they configure?

Accepted Answer

Set a rotation period of 30 days on the key.. Cloud KMS allows you to set a rotation period directly on a key (a CryptoKey resource) when its purpose is ENCRYPT_DECRYPT. Configuring a rotation period of 30 days on the key enables automatic, scheduled rotation, where Cloud KMS creates a new key version every 30 days and promotes it to primary, without any manual intervention.

Answer

Use a cron job to rotate keys manually every 30 days.

Answer

Set a rotation period of 30 days on the key ring.

Answer

Set a rotation period on the key version.

Question 9

Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed information about actions taken by Google staff when accessing customer data. Access Approval is a separate feature that requires approval before access. Audit Logs is a broader category. Cloud DLP is for data loss prevention.

Answer

Access Approval

Answer

Cloud DLP

Answer

Cloud Audit Logs

Question 10

A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.. Secret Manager can set a rotation period and publish a Pub/Sub message upon rotation. A Cloud Function can subscribe to that topic and execute updates. Directly triggering from Secret Manager is not possible. Cloud Scheduler is not needed.

Answer

Manually rotate the secret and set a Cloud Scheduler job to invoke the Cloud Function.

Answer

Use Cloud Scheduler to call the Secret Manager API to add a new version every 60 days, then trigger a Cloud Function via HTTP.

Answer

Set a rotation period on the secret and directly specify a Cloud Function as a webhook in Secret Manager.

Question 11

An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?

Accepted Answer

Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.. Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Answer

Assign the roles/storage.admin IAM role with a condition that restricts region.

Answer

Use Assured Workloads to enforce data residency.

Answer

Define a bucket policy that allows only europe-west1.

Question 12

A financial services company uses BigQuery for analytics and needs to implement column-level security such that users with the role 'data_scientist' can see the last four digits of credit card numbers, while the full number is visible only to 'data_owner'. What approach should they use?

Accepted Answer

Use a policy tag with a data masking rule that masks the full number except last four digits, and grant UNMASKED access to data_owner and MASKED access to data_scientist.. BigQuery's policy tags with data masking rules allow you to define column-level masking policies. By creating a masking rule that reveals only the last four digits of the credit card number, you can grant the `data_scientist` role MASKED access (which applies the mask) and the `data_owner` role UNMASKED access (which bypasses the mask). This approach enforces column-level security without duplicating data or using row-level filters.

Answer

Set an IAM condition on the table that filters the column based on the user's role.

Answer

Use row-level security to restrict rows based on role.

Answer

Create two separate BigQuery tables (one with masked data, one with full data) and grant access based on role.

Question 13

What is the purpose of the Cloud DLP InfoType detector CREDIT_CARD_NUMBER?

Accepted Answer

It detects credit card numbers in data during inspection.. InfoType detectors in Cloud DLP (Sensitive Data Protection) are pattern/checksum-based recognizers that identify specific data categories during inspection. CREDIT_CARD_NUMBER uses a regex plus the Luhn checksum to detect valid payment card numbers in scanned content. Detection is the prerequisite step; any redaction, masking, or de-identification happens only after a detector flags a match.

Answer

It encrypts credit card numbers automatically.

Answer

It redacts credit card numbers from images.

Answer

It de-identifies credit card numbers using masking.

Question 14

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to ensure that Google does not store the key material. What must they do?

Accepted Answer

Use the gcloud compute disks create command with the --csek-key-file flag to supply the key, and do not store the key in Cloud KMS.. Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Answer

Enable Cloud HSM to protect the key.

Answer

Set an organization policy to prevent Google from storing keys.

Answer

Create a Cloud KMS key and use it as a CSEK.

Question 15

A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?

Accepted Answer

Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.. Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Answer

Use VPC Service Controls to prevent data exfiltration.

Answer

Set IAM conditions on all resources to allow only US regions.

Answer

Use Cloud DLP to scan and block data leaving the US.