PCSE Ensuring Data Protection Practice Test 6 — 15 Questions

Question 1

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted using keys that they manage and rotate on a schedule they control. The keys must be stored in a FIPS 140-2 Level 3 validated HSM. Which encryption approach should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud HSM. Customer-Managed Encryption Keys (CMEK) combined with Cloud HSM allow customers to manage their own keys in a FIPS 140-2 Level 3 validated HSM. Google-managed keys do not give customer control, and Customer-Supplied Encryption Keys (CSEK) require the customer to supply the key with each API call and Google does not store the key, which is impractical for many use cases and does not use HSM.

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys (GMEK)

Question 2

A company uses BigQuery to store sensitive customer data. They want to restrict access to certain columns (e.g., email and SSN) so that only authorized users see the actual values, while other users see a masked version. Which approach should they use?

Accepted Answer

Use BigQuery column-level security with policy tags and data masking rules.. BigQuery column-level security using policy tags and data masking rules allows you to define fine-grained access controls and masking policies on specific columns. This is the recommended approach for column-level access and masking in BigQuery.

Answer

Create separate views for different user groups, each with different column projections.

Answer

Use Cloud Storage signed URLs to grant time-limited access to the data.

Answer

Use Cloud DLP to scan BigQuery tables and create de-identification jobs that permanently mask the data in the table.

Question 3

An organization needs to store API keys and database credentials in a secure, centralized service that supports automatic rotation and integrates with Cloud Functions. The solution must provide fine-grained access control at the secret version level. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets such as API keys and database credentials. It supports versioning, IAM roles with fine-grained access (e.g., secretmanager.versions.access), and automatic rotation via Pub/Sub notifications triggering Cloud Functions.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Storage with customer-managed encryption keys

Answer

Cloud HSM

Question 4

A healthcare organization must ensure that Protected Health Information (PHI) stored in Cloud Storage buckets is not inadvertently shared. They want to automatically scan all new objects added to the bucket for sensitive data and log findings. Which approach should they use?

Accepted Answer

Use Cloud DLP inspection job triggers with a schedule to scan the bucket periodically.. Cloud DLP job triggers can be configured to scan Cloud Storage buckets on a schedule or event-driven (e.g., via Cloud Storage Pub/Sub notifications). The trigger will inspect objects for sensitive data and log results. This meets the requirement for automatic scanning.

Answer

Use Data Loss Prevention (DLP) API to manually scan the bucket each time a new object is added.

Answer

Use Access Transparency logs to monitor all access to the bucket.

Answer

Use Cloud Audit Logs and create a log-based metric to detect sensitive data.

Question 5

A company wants to enforce that all new Cloud Storage buckets are created in only the europe-west1 region. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint gcp.resourceLocations restricts the locations where resources can be created. By setting this constraint with a list of allowed locations (e.g., europe-west1), new buckets can only be created in those regions.

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/compute.requireOsLogin

Answer

constraints/iam.disableServiceAccountCreation

Question 6

What is the purpose of Cloud HSM?

Accepted Answer

To provide FIPS 140-2 Level 3 validated hardware security for key material. Cloud HSM is a managed hardware security module (HSM) service that provides FIPS 140-2 Level 3 validated security for cryptographic keys. It allows you to generate, store, and manage keys in a tamper-resistant hardware device.

Answer

To manage secrets such as API keys and passwords

Answer

To automatically rotate encryption keys

Answer

To encrypt data at rest using Google-managed keys

Question 7

A security engineer wants to enable Access Transparency for their organization. After enabling it in the Admin Console, they notice that some access logs are missing. What is the most likely reason?

Accepted Answer

The service being accessed does not support Access Transparency.. Access Transparency logs are only generated for services that support Access Transparency and have the feature enabled. At the time of writing, not all GCP services support Access Transparency. If the missing logs are for unsupported services, they will not appear.

Answer

Access Transparency only logs access by Google personnel, not by third-party vendors.

Answer

Access Transparency must be enabled for each individual project, not just the organization.

Answer

The IAM policy for the organization does not grant the required permissions.

Question 8

An engineer needs to configure automatic key rotation for a symmetric encryption key in Cloud KMS. They have set the rotation period to 90 days. What happens to the old key material after rotation?

Accepted Answer

The old key version remains enabled and can still be used for decryption.. When a key is rotated, a new key version is created and becomes the primary. The old version is retained and remains available for decrypting data encrypted with it. Key material is not automatically deleted; it can be disabled or scheduled for destruction separately.

Answer

The old key version is disabled and can be re-enabled if needed.

Answer

The old key material is immediately deleted.

Answer

The old key material is moved to a pending destruction state for 24 hours.

Question 9

Which Cloud DLP transform should be used to replace sensitive data with a token that preserves the format and length of the original data for reversible de-identification?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace data with a token that retains the original format and length, and the process is reversible with the encryption key.

Answer

DateShiftConfig

Answer

MaskingConfig

Answer

BucketingConfig

Question 10

After deleting a Cloud KMS key version, an engineer receives an error when trying to decrypt data that was encrypted with that key version. The key version was deleted 12 hours ago. What is the most likely cause?

Accepted Answer

The key version was destroyed immediately upon deletion because the grace period is configurable.. When a key version is destroyed before the grace period expires, it is destroyed immediately. The default grace period is 24 hours, but if the key version was deleted (not scheduled for destruction), it may have been destroyed immediately. Cloud KMS does not allow recovery after destruction.

Answer

The key version was automatically rotated and is no longer the primary.

Answer

The key version is disabled and needs to be re-enabled.

Answer

The key version is in a pending destruction state and can be restored within 24 hours.

Question 11

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data as it is inserted into a new table using a DLP de-identification template. Which approach should they use?

Accepted Answer

Create a DLP de-identification template and apply it to the BigQuery table using a DLP job.. Cloud DLP can be used to create a de-identification template and then apply it to data in BigQuery via a DLP job or by using the DLP API to transform data on the fly. However, to automatically de-identify data as it is inserted, a common pattern is to use Cloud Functions triggered by BigQuery streaming inserts or scheduled DLP jobs that transform the data and write to a new table.

Answer

Use Cloud Audit Logs to monitor insertions and manually run a DLP transformation.

Answer

Use Cloud DLP inspection job triggers to scan the table and send notifications.

Answer

Use BigQuery column-level security with data masking rules.

Question 12

An organization needs to comply with ITAR regulations. They want to ensure that all data processed by their GCP resources remains within the United States. Which service should they use?

Accepted Answer

Assured Workloads. Assured Workloads provides regulatory compliance controls, including support for ITAR. It helps enforce data residency and access controls required for ITAR workloads.

Answer

VPC Service Controls

Answer

Cloud DLP

Answer

Organization policy constraint gcp.resourceLocations

Question 13

A company wants to automatically rotate secrets stored in Secret Manager every 30 days. They have set up a Pub/Sub topic and a Cloud Function to perform the rotation. Which TWO actions are required to complete the configuration? (Choose two.)

Accepted Answer

Set the rotation period on the secret to 30 days.. To enable automatic rotation, you need to configure a rotation period and a Pub/Sub topic. The rotation period defines how often the secret is rotated, and the Pub/Sub topic is used to notify the Cloud Function when rotation is due.

Answer

Grant the Cloud Functions service account the secretmanager.secretVersionManager role on the secret.

Answer

Create a Cloud Scheduler job to call the Secret Manager API every 30 days.

Answer

Enable automatic rotation in the Cloud Console by toggling the 'Enable rotation' switch.

Question 14

A security engineer is designing a data residency strategy for a healthcare organization that must keep all data within the European Union. They plan to use Assured Workloads to meet this requirement. Which THREE additional controls should they implement to further enforce data residency and protect data? (Choose three.)

Accepted Answer

Organization policy constraint gcp.resourceLocations set to allow only European regions.. To enforce data residency, you can use Organization Policy constraints to restrict resource locations, VPC Service Controls to prevent data exfiltration, and Access Transparency to monitor Google personnel access. Cloud HSM is about key storage, not residency; Data Loss Prevention is about data classification, not residency.

Answer

Cloud HSM to store encryption keys.

Answer

Cloud DLP to scan for sensitive data.

Question 15

A company is using Cloud KMS with software keys for encryption. They want to increase security by using an HSM backend without changing their existing key rings or key names. Which TWO steps should they take? (Choose two.)

Accepted Answer

Create a new key version with the protection level set to HSM.. To switch a key from software to HSM backend, you need to create a new key version with the protection level HSM, and then update the key's default protection level to HSM so that future versions are also HSM-backed. You cannot change the protection level of an existing key version.

Answer

Create a new key ring and migrate all keys to it.

Answer

Change the protection level of the existing key version to HSM using the API.

Answer

Delete the existing software key versions and recreate them with HSM protection.