PCSE Ensuring Data Protection Practice Test 8 — 15 Questions

Question 1

A company uses CMEK with Cloud HSM to encrypt a BigQuery table. The security engineer accidentally deleted the key in Cloud KMS. The key is now in a 'pending destruction' state with a grace period of 24 hours. Which action should the engineer take to restore the key and avoid data loss?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restore the key by canceling the destruction within the grace period. When a Cloud KMS key is deleted, it enters a 'pending destruction' state with a configurable grace period (default 24 hours). During this window, the key is not yet destroyed and can be restored by canceling the scheduled destruction. This action returns the key to an enabled state, allowing BigQuery to continue decrypting data encrypted with that key. Since the key material is still intact, canceling destruction is the correct and only way to restore the key without data loss.

Answer

Recreate the key with the same name and version

Answer

Wait for the grace period to expire and then use a backup key

Answer

Use Access Transparency logs to recover the key material

Question 2

A company wants to use Cloud DLP to inspect Cloud Storage buckets for phone numbers that match a custom pattern (e.g., +1-XXX-XXX-XXXX). The pattern is not covered by built-in infoTypes. How should the engineer configure the DLP job?

Accepted Answer

Create a custom infoType with a regex pattern. Cloud DLP allows you to define custom infoTypes using regular expressions to match patterns not covered by built-in infoTypes. By creating a custom infoType with a regex pattern like `\+1-\d{3}-\d{3}-\d{4}`, the DLP job can inspect Cloud Storage buckets for phone numbers in the specified format. This approach directly addresses the requirement without relying on external services or unsupported built-in types.

Answer

Use the built-in PHONE_NUMBER infoType

Answer

Use Cloud Functions to scan the files and call DLP API

Answer

Store the pattern in Secret Manager and reference it in the DLP job

Question 3

A security engineer needs to view logs of Google Cloud support engineers accessing their data to meet compliance requirements. Which GCP feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides logs of when Google Cloud support engineers (or other Google personnel) access your data or configuration, giving you an audit trail for compliance. It is specifically designed to show Google's own access to your environment, which is distinct from your users' access. This is the feature that satisfies the requirement to view logs of Google support engineer access.

Answer

Access Approval

Answer

Audit Logs

Answer

VPC Flow Logs

Question 4

A security engineer needs to implement de-identification of sensitive data in a Cloud Storage bucket using Cloud DLP. They want to inspect the data for credit card numbers and then replace them with a tokenized value that preserves the format for downstream processing. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure an inspection job with the built-in CREDIT_CARD_NUMBER infoType. Option B is correct because the built-in CREDIT_CARD_NUMBER infoType is specifically designed to detect credit card numbers during a Cloud DLP inspection job, so it directly satisfies the requirement to inspect the data for credit card numbers. Option C is correct because CryptoReplaceFfxFpeConfig applies format-preserving encryption (FFX/FPE) using a cryptographic key, which replaces the detected values with tokenized output while preserving the original format for downstream processing. Option A is incorrect because DateShiftConfig only shifts date values and cannot tokenize credit card numbers. Option D is incorrect because a custom infoType is unnecessary when the built-in CREDIT_CARD_NUMBER infoType already detects credit card numbers. Option E is incorrect because BucketingConfig replaces values with range buckets rather than format-preserving tokens.

Answer

Use the DateShiftConfig de-identification transform

Answer

Create a custom infoType for credit card numbers

Answer

Use the BucketingConfig de-identification transform

Question 5

A company must comply with regulatory requirements that restrict data access by Google Cloud support and engineering staff. They need to log all Google admin access to their data and also require explicit approval before access is granted. Which TWO features should they combine? (Choose two.)

Accepted Answer

Access Approval. Access Approval (A) is correct because it enforces explicit approval before Google support or engineering staff can access the customer's data, satisfying the requirement that access be granted only after approval. Access Transparency (D) is correct because it produces logs of Google administrators' actions on customer data, satisfying the requirement to log all Google admin access. Together they address both the approval and logging requirements. Data Loss Prevention (B) is for discovering and redacting sensitive data, not for controlling or logging Google staff access. VPC Service Controls (C) creates service perimeters to mitigate data exfiltration but does not log or approve Google admin access. Audit Logs (E) record actions by users and services within the project but do not capture Google administrator access to customer data, which is the specific scope of Access Transparency.

Answer

Data Loss Prevention

Answer

VPC Service Controls

Answer

Audit Logs

Question 6

An organization needs to store API keys and database credentials in a central, auditable service with versioning and IAM access control. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing secrets like API keys, certificates, and database passwords. It provides versioning, IAM policies (e.g., secretmanager.versions.access), and automatic rotation with Pub/Sub notifications.

Answer

Cloud HSM

Answer

Cloud DLP

Answer

Cloud KMS

Question 7

A company uses Cloud DLP to scan a BigQuery table for sensitive data. They want to automatically mask credit card numbers in query results for users who are not data stewards. Which approach should they use?

Accepted Answer

Create a BigQuery Data Policy with masking rules on the column and assign appropriate IAM roles. BigQuery column-level security with data masking rules (via BigQuery Data Policy) allows defining masking policies (e.g., email masking, hash masking) that are automatically applied to query results based on user IAM. DLP inspection can identify the sensitive columns, but the masking is enforced by BigQuery policies.

Answer

Enable Access Transparency to log queries and manually review

Answer

Use Cloud DLP de-identification jobs to replace credit card numbers with tokens in the source table

Answer

Use Cloud DLP inspect job and then manually apply a view that masks the column

Question 8

A financial institution must store data in specific EU regions to comply with GDPR. They want to prevent users from creating resources in other regions. Which organization policy should they set?

Accepted Answer

Set the `gcp.resourceLocations` constraint at the organization or folder level. The `gcp.resourceLocations` organization policy constraint is the correct mechanism to restrict where resources can be created in Google Cloud. By setting this list constraint at the organization or folder level, you can specify allowed locations (e.g., EU regions), and any attempt to create a resource outside those regions will be denied. This directly enforces GDPR data residency requirements without relying on IAM roles or service-specific configurations.

Answer

Use IAM roles to restrict Compute Engine instance creation

Answer

Create an Assured Workloads folder with EU data boundary

Answer

Configure Cloud KMS key ring location constraint

Question 9

A security engineer needs to audit all administrative actions performed by Google support engineers on their GCP project. Which service provides near-real-time logs of such access?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of actions taken by Google support engineers and other Google personnel when they access your GCP project's data or configuration. It is specifically designed for this insider-access auditing use case, producing logs that show who accessed what, when, and why. Cloud Audit Logs, by contrast, capture actions performed by principals in your own organization, not Google support staff.

Answer

Cloud Audit Logs

Answer

Cloud DLP

Answer

VPC Flow Logs

Question 10

Which Cloud KMS key purpose should be used to encrypt and decrypt data directly?

Accepted Answer

ENCRYPT_DECRYPT. The ENCRYPT_DECRYPT purpose in Cloud KMS is designed for symmetric keys used to directly encrypt and decrypt data, such as AES-256 keys for application secrets, database fields, or envelope encryption of data keys. This is the only purpose that supports both encrypt and decrypt operations on arbitrary plaintext. Asymmetric purposes are split into separate sign/verify and encrypt/decrypt key pairs, and MAC keys are for HMAC integrity only.

Answer

ASYMMETRIC_DECRYPT

Answer

ASYMMETRIC_SIGN

Answer

MAC

Question 11

An engineer needs to schedule automatic rotation of a symmetric key in Cloud KMS every 30 days. The key is currently enabled. What should they do?

Accepted Answer

Set the rotation period on the key via 'gcloud kms keys update'. To schedule automatic rotation of an existing symmetric key in Cloud KMS, you set the rotation period on the key using 'gcloud kms keys update' with the --rotation-period flag. This configures the key to automatically create a new key version at the specified interval (e.g., 30 days).

Answer

Automatic rotation is not supported for symmetric keys

Answer

Set a rotation period via 'gcloud kms keyrings create'

Answer

Manually create a new key version every 30 days using 'gcloud kms keys versions create'

Question 12

An organization needs to de-identify a BigQuery column containing US Social Security Numbers (SSNs) by replacing them with a consistent token that can be reversed if needed. Which Cloud DLP de-identification transform should they use?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig performs format-preserving encryption using FFX mode, which replaces sensitive values with reversible tokens that preserve the original format (e.g., a 9-digit SSN becomes another 9-digit token). Because it is reversible with the correct crypto key, it satisfies the requirement for consistent, reversible tokenization.

Answer

BucketingConfig

Answer

MaskingConfig

Answer

DateShiftConfig

Question 13

A security team wants to automatically rotate a database password stored in Secret Manager every 60 days and notify the operations team when a new version is created. Which approach should they use?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications; use a Cloud Function to generate new password. Secret Manager supports automatic rotation by setting a rotation period and a rotation schedule, and it can publish rotation notifications to a Pub/Sub topic. A Cloud Function (or Cloud Run) is typically used to generate the new password and add it as a new secret version. This combination provides automated rotation and event-driven notification to the operations team.

Answer

Use Cloud Scheduler to call Secret Manager API to add a new version

Answer

Use Cloud KMS key rotation to rotate the secret

Answer

Manually update the secret every 60 days

Question 14

A company is subject to ITAR regulations and needs to ensure that all data stored in GCP remains within the United States. They also require FIPS 140-2 Level 3 validation for encryption keys. Which two services should they use together to meet these requirements? (Choose 2)

Accepted Answer

Cloud HSM. Assured Workloads (D) is correct because it is the GCP service designed to enforce data residency and compliance controls, including ITAR and US-only data location restrictions, by applying policy guardrails to a folder or project. Cloud HSM (B) is correct because it provides FIPS 140-2 Level 3 validated hardware security modules for encryption key generation, storage, and cryptographic operations, satisfying the key protection requirement. Used together, Assured Workloads enforces the US data boundary while Cloud HSM supplies the required Level 3 validated key management. Cloud KMS with software keys (A) is not appropriate because software-backed keys only meet FIPS 140-2 Level 1, not Level 3. Cloud DLP (C) is a data discovery and redaction service, not a residency or key-validation control. Secret Manager (E) stores secrets such as API keys and passwords but does not provide FIPS 140-2 Level 3 HSM-backed keys or enforce ITAR data residency.

Answer

Cloud KMS with software keys

Answer

Cloud DLP

Answer

Secret Manager

Question 15

An organization wants to ensure that all new resources created in Google Cloud are restricted to a specific set of regions to meet data residency requirements. Which policy should they use?

Accepted Answer

Configure the `gcp.resourceLocations` organization policy constraint. The `gcp.resourceLocations` organization policy constraint allows administrators to define a list of allowed regions where resources can be created. This directly enforces data residency requirements by restricting resource creation to specific locations. It is the correct policy for this use case.

Answer

Define a service perimeter using VPC Service Controls

Answer

Use IAM conditions to deny access outside approved regions

Answer

Enable Data Residency in Cloud Console settings