PCSE Ensuring Data Protection Practice Test 7 — 15 Questions

Question 1

Which two statements correctly describe Cloud KMS key versions? (Choose TWO.)

Accepted Answer

Key versions are immutable once created.. Option A is correct because Cloud KMS key versions are immutable: once a version is created, its key material cannot be changed or regenerated in place; any new key material requires creating a new key version. Option D is correct because a key version can be disabled, which immediately prevents it from being used for cryptographic operations while preserving the key material and version state for possible re-enabling. Option B is wrong because automatic rotation in Cloud KMS works by creating a new key version on a schedule, not by rotating the existing version without creating a new one. Option C is wrong because key version destruction is not immediate: it enters a scheduled-destruction state with a configurable delay (default 30 days) before permanent destruction. Option E is wrong because purpose is a property of the CryptoKey, not of individual key versions, so all versions of a key share the same purpose.

Answer

Key versions can be rotated automatically without creating a new version.

Answer

The destruction of a key version is immediate upon request.

Answer

Each key version can have a different purpose.

Question 2

An organization wants to encrypt data at rest using customer-managed keys on Compute Engine persistent disks. They need to provide the key material with each API call, and Google should never store the key. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-supplied encryption keys (CSEK) allow the customer to provide the encryption key with each API call, and Google does not store the key on its infrastructure. This matches the requirement that key material be supplied per API call and never retained by Google. CMEK, by contrast, stores the key in Cloud KMS, which Google manages.

Answer

Cloud HSM

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK)

Question 3

A security engineer wants to automatically rotate a database password stored in Secret Manager every 30 days. The new password should be generated and stored in Secret Manager without manual intervention. Which approach meets these requirements?

Accepted Answer

Configure a rotation period in Secret Manager, set a Pub/Sub topic, and implement a Cloud Function that listens for rotation messages to generate and add a new secret version.. Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Answer

Set up a Cloud Lifecycle rule to delete the old secret version and create a new one with the same value.

Answer

Use a Cloud KMS key to re-encrypt the secret each month.

Answer

Use gcloud secrets versions add with a scheduled Cloud Scheduler job that generates a new password and adds it as a new version.

Question 4

A healthcare company stores patient data in BigQuery and needs to mask sensitive columns like SSN and email for analysts who do not need to see the actual values. They want to apply consistent masking across queries without modifying the underlying data. Which feature should they use?

Accepted Answer

BigQuery Data Policy with data masking rules. BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Answer

IAM conditions on tables

Answer

Authorized views with row-level security

Answer

Cloud DLP de-identification transforms on export

Question 5

A company uses Cloud KMS with an HSM key for encryption of sensitive data. The compliance team requires that the key material never leaves the HSM boundary. They plan to use the key for symmetric encryption/decryption. Which key purpose should they specify when creating the key?

Accepted Answer

ENCRYPT_DECRYPT. For symmetric encryption/decryption using Cloud KMS, the key purpose must be ENCRYPT_DECRYPT. This purpose supports both encryption and decryption operations with symmetric keys. The HSM-backed key ensures key material never leaves the HSM boundary, satisfying compliance.

Answer

ASYMMETRIC_SIGN

Answer

ASYMMETRIC_DECRYPT

Answer

MAC

Question 6

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) such as credit card numbers and social security numbers. The scanning must be performed on a schedule (every week). Which GCP service and resource should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) with a DLP job trigger. Cloud Data Loss Prevention (DLP) is GCP's service for discovering, classifying, and de-identifying sensitive data such as credit card numbers and SSNs using built-in infoType detectors. To run scans on a schedule, you create a DLP job trigger that defines the scan configuration and a recurrence (e.g., every week), targeting the Cloud Storage bucket. This directly satisfies both the PII detection requirement and the weekly scheduling requirement.

Answer

Cloud Security Command Center (SCC)

Answer

Cloud Asset Inventory

Answer

Cloud Audit Logs

Question 7

A financial institution is required to store customer transaction data within the European Union to comply with GDPR data residency requirements. They want to prevent users from creating resources in any region outside the EU. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint gcp.resourceLocations restricts the locations where Google Cloud resources can be created. By setting a list of allowed locations (e.g., europe-west1, europe-west4), resources cannot be created in non-EU regions.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/sql.restrictAuthorizedNetworks

Question 8

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

Accepted Answer

The old key version remains available for decryption of existing data.. When Cloud KMS rotates a symmetric key, it creates a new key version but does not delete or disable the old version. The old key version remains enabled and available for decryption, so data encrypted with it can still be decrypted. New encryptions use the new primary version, but existing ciphertext is unaffected.

Answer

The old key version is immediately disabled, and all data must be re-encrypted.

Answer

Data encrypted with the old key is automatically re-encrypted with the new key.

Answer

The old key version is deleted after the rotation period.

Question 9

An organization wants to use a FIPS 140-2 Level 3 validated hardware security module (HSM) to protect encryption keys in Cloud KMS. Which key protection level should they choose when creating a key ring?

Accepted Answer

hsm. In Cloud KMS, the 'hsm' protection level uses a FIPS 140-2 Level 3 validated hardware security module to protect key material, which is exactly what the organization requires. The 'software' and 'cloud' levels use software-based key protection, and 'external' refers to keys managed outside Google Cloud. Therefore, 'hsm' is the correct choice.

Answer

software

Answer

cloud

Answer

external

Question 10

A data scientist needs to access a secret stored in Secret Manager from a Compute Engine VM. The VM has the default service account attached. Which IAM role should be granted to the service account to allow reading the secret?

Accepted Answer

roles/secretmanager.secretAccessor. The correct role is roles/secretmanager.secretAccessor because it grants the specific permission secretmanager.versions.access required to read the secret payload from Secret Manager. The default Compute Engine service account needs only this minimal permission to retrieve the secret value, following the principle of least privilege.

Answer

roles/secretmanager.admin

Answer

roles/iam.serviceAccountUser

Answer

roles/secretmanager.viewer

Question 11

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data before loading it into another BigQuery dataset for analysis. Which THREE components must be configured? (Choose three.)

Accepted Answer

A DLP job trigger. To automatically de-identify data from BigQuery, a DLP job must be configured with a de-identification template. The inspection template identifies sensitive info types. The job can write results to a new BigQuery table. A job trigger schedules the job.

Answer

A Cloud KMS key for encryption of the output

Answer

A BigQuery authorized view

Question 12

A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud HSM. CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with software keys

Answer

Customer-supplied encryption keys (CSEK)

Question 13

A security engineer needs to store database credentials and API keys securely in GCP. The solution must support automatic rotation of secrets at a defined schedule and trigger a Cloud Function after each rotation to update dependent applications. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports versioning, IAM access, and automatic rotation with Pub/Sub notifications. Cloud Functions can subscribe to the Pub/Sub topic to perform post-rotation tasks. Cloud KMS manages keys, not secrets. Cloud DLP is for data loss prevention. Cloud Storage is not designed for secret management with rotation.

Answer

Cloud KMS

Answer

Cloud DLP

Answer

Cloud Storage

Question 14

A security engineer needs to enforce that all new Compute Engine disks are created in a specific geographic region to meet data residency requirements. Which organization policy constraint should they use?

Accepted Answer

gcp.resourceLocations. The constraint 'gcp.resourceLocations' restricts where Google Cloud resources can be created. It can be set to a list of allowed locations. The other constraints: 'iam.allowedPolicyMemberDomains' restricts member domains, 'compute.skipDefaultNetworkCreation' prevents default network creation, 'constraints/compute.trustedImageProjects' restricts image projects.

Answer

constraints/compute.trustedImageProjects

Answer

compute.skipDefaultNetworkCreation

Answer

iam.allowedPolicyMemberDomains

Question 15

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They want to rotate the key automatically every 90 days. What must the security engineer configure to achieve this?

Accepted Answer

Set the rotation period on the key to 7776000 seconds. To automatically rotate a Cloud KMS key every 90 days, you must set the rotation period on the key. The rotation period is specified in seconds, and 90 days equals 7,776,000 seconds (90 * 24 * 60 * 60). This configuration enables automatic rotation of the key material. The other options do not achieve automatic rotation: asymmetric keys cannot be rotated automatically, disabling versions does not rotate, and manual rotation is not automatic.

Answer

Use a key with ASYMMETRIC_SIGN purpose

Answer

Set the key version state to 'disabled' after 90 days

Answer

Manually rotate the key every 90 days using gcloud command