PCSE Ensuring Data Protection Practice Test 9 — 15 Questions

Question 1

A security engineer needs to automatically rotate a database password stored in Secret Manager every 60 days. Which approach meets this requirement with minimal operational overhead?

Accepted Answer

Set the rotation period in Secret Manager to 60 days and configure a Pub/Sub topic to trigger a Cloud Function that generates a new password. Secret Manager's rotation feature works by publishing a message to a Pub/Sub topic when the rotation period elapses; the actual password generation and update must be performed by a consumer (typically a Cloud Function or Cloud Run service) that you configure. Option D correctly pairs the 60-day rotation schedule with a Pub/Sub-triggered Cloud Function that generates and writes the new password back to the secret. This is the only option that both schedules rotation and provides the mechanism to actually change the credential, satisfying the requirement with minimal operational overhead since it is fully serverless.

Answer

Set the secret's `next_rotation_time` to 60 days from now; no further action needed

Answer

Enable automatic rotation with a 60-day period in Cloud KMS, which will automatically update the secret

Answer

Use a cron job on Compute Engine to update the secret every 60 days

Question 2

An organization needs to store API keys for external services. Which Google Cloud service is designed for secure storage of secrets such as API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Google Cloud Secret Manager is purpose-built for storing, managing, and accessing secrets like API keys, passwords, and certificates. It provides versioning, IAM-based access control, audit logging, and automatic rotation capabilities, making it the correct service for secure secret storage.

Answer

Cloud KMS

Answer

Cloud Datastore

Answer

Cloud HSM

Question 3

A company wants to enforce that all Compute Engine disk encryption uses keys managed by their own HSM on-premises, with keys provided per API call. Which encryption type should they choose when creating a persistent disk?

Accepted Answer

Customer-supplied encryption (CSEK). Customer-supplied encryption keys (CSEK) are the only GCP disk encryption option where the customer provides the raw AES-256 key material with each API call to Compute Engine. Because the keys never reside in Google Cloud and are supplied per request, they satisfy the requirement that keys be managed by an on-premises HSM and passed in per API call. CSEK keys are not stored by Google; only a SHA-256 hash of the key is retained to validate future requests.

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM-backed keys

Answer

Customer-managed encryption (CMEK) with Cloud KMS

Question 4

An organization needs to audit when Google administrators access their customer content stored in GCP. Which service provides near-real-time logs of such access?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs when Google staff access customer content, offering visibility into administrative actions.

Answer

VPC Flow Logs

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Question 5

A data engineer wants to classify columns in BigQuery containing sensitive data like email addresses and apply data masking so that users see only masked values (e.g., 'j***@example.com'). Which feature should they use?

Accepted Answer

BigQuery column-level security with policy tags and data masking rules. BigQuery column-level security with policy tags and data masking rules allows classification of sensitive columns (e.g., email) and application of masking policies so users see masked values like 'j***@example.com'. Policy tags are managed via Data Catalog, and masking rules are applied to the tag. This is the native, centralized feature for dynamic data masking.

Answer

Cloud DLP inspection jobs

Answer

Cloud IAM roles for BigQuery

Answer

View with SQL masking

Question 6

A company using Cloud KMS wants to automatically rotate a symmetric encryption key every 90 days. What is the correct way to configure this?

Accepted Answer

Set the rotation period on the cryptographic key to 90 days. In Cloud KMS, automatic rotation is configured on the cryptographic key itself, not on the key ring. The rotation period is set when creating or updating a key, and it applies to symmetric encryption keys. Setting the rotation period to 90 days on the key ensures that a new key version is generated every 90 days, and the old versions are retained for decryption. This is the correct way to automate key rotation.

Answer

Set the key purpose to ASYMMETRIC_SIGN for automatic rotation

Answer

Set the rotation period to 90 days when creating the key ring

Answer

Use Cloud Scheduler to call `cloudkms.rotateKey` every 90 days

Question 7

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

Accepted Answer

Cloud HSM. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

Answer

Secret Manager

Answer

Cloud KMS with software-backed keys

Answer

Cloud External Key Manager

Question 8

A company needs to enforce data residency in the European Union for all GCP resources. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Assured Workloads with an EU data boundary. Option B is correct because Assured Workloads provides a compliance-focused environment with an EU data boundary that enforces data residency controls (such as data location and personnel access) for the resources deployed within the folder it governs. Option C is correct because the organization policy constraint `gcp.resourceLocations` (set via `constraints/gcp.resourceLocations`) restricts where resources can be created at the organization, folder, or project level, allowing only EU locations and thereby enforcing data residency. Option A is not correct because a VPC Service Perimeter controls access to services and data based on context (e.g., trusted networks, identities), not the physical region where resources are stored, so it does not by itself enforce data residency. Option D is not correct because IAM policies govern identities and permissions, not the geographic location of resource creation or storage, so they cannot enforce data residency. Option E is not correct because Cloud Audit Logs only record and monitor activity; they provide visibility into resource creation but do not prevent or enforce resources from being created outside the EU.

Answer

Create a VPC Service Perimeter that only allows access from EU regions

Answer

Set IAM policies to deny access to non-EU regions

Answer

Enable Cloud Audit Logs to monitor resource creation outside EU

Question 9

An organization needs to store API keys and database credentials in a secure, centralized service that supports automatic rotation and integrates with Cloud Functions. The solution must provide fine-grained access control at the secret version level. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing API keys, passwords, and database credentials, supports automatic rotation via rotation schedules and Pub/Sub notifications, integrates natively with Cloud Functions through client libraries, and provides IAM access control at the secret and secret-version level. This matches every requirement in the question.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Storage with customer-managed encryption keys

Answer

Cloud HSM

Question 10

A company wants to enforce that all new Cloud Storage buckets are created in only the europe-west1 region. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint constraints/gcp.resourceLocations allows you to restrict the locations where resources can be created, including Cloud Storage buckets. By setting this constraint to allow only europe-west1, you enforce that all new buckets are created in that region. This is the correct constraint for location-based restrictions.

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/compute.requireOsLogin

Answer

constraints/iam.disableServiceAccountCreation

Question 11

What is the purpose of Cloud HSM?

Accepted Answer

To provide FIPS 140-2 Level 3 validated hardware security for key material. Cloud HSM provides FIPS 140-2 Level 3 validated hardware security modules for storing and managing encryption keys. Its primary purpose is to offer hardware-backed key protection, ensuring that key material is stored in tamper-resistant hardware. This meets stringent compliance requirements for key management.

Answer

To manage secrets such as API keys and passwords

Answer

To automatically rotate encryption keys

Answer

To encrypt data at rest using Google-managed keys

Question 12

A security engineer wants to enable Access Transparency for their organization. After enabling it in the Admin Console, they notice that some access logs are missing. What is the most likely reason?

Accepted Answer

The service being accessed does not support Access Transparency.. Access Transparency logs are generated only for Google personnel actions on supported services. If some logs are missing after organization-level enablement, the most likely cause is that the service being accessed does not support Access Transparency. Enablement at the organization level does not extend coverage to unsupported services.

Answer

Access Transparency only logs access by Google personnel, not by third-party vendors.

Answer

Access Transparency must be enabled for each individual project, not just the organization.

Answer

The IAM policy for the organization does not grant the required permissions.

Question 13

Which Cloud DLP transform should be used to replace sensitive data with a token that preserves the format and length of the original data for reversible de-identification?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig is a Cloud DLP transform that uses format-preserving encryption (FPE) with the FFX mode to replace sensitive data with a token that maintains the original format and length, and it is reversible if you have the crypto key. This matches the requirement for reversible de-identification that preserves format and length.

Answer

DateShiftConfig

Answer

MaskingConfig

Answer

BucketingConfig

Question 14

An organization needs to comply with ITAR regulations. They want to ensure that all data processed by their GCP resources remains within the United States. Which service should they use?

Accepted Answer

Assured Workloads. Assured Workloads is correct because it is a GCP service specifically designed to enforce compliance controls for regulated workloads, including ITAR, FedRAMP, and CJIS. It provides data residency guarantees by restricting resource locations to US regions and enforces personnel access controls, ensuring that data and support access remain within the United States. This directly addresses ITAR's requirement that controlled technical data not be accessible to non-US persons.

Answer

VPC Service Controls

Answer

Cloud DLP

Answer

Organization policy constraint gcp.resourceLocations

Question 15

An organization stores sensitive customer data in BigQuery tables. They need to enforce column-level security such that users in the 'support' group see a masked version of email addresses (e.g., j***@example.com), while managers see the full email. Which approach should they use?

Accepted Answer

Apply a BigQuery data masking policy using policy tags on the email column.. BigQuery data masking policies use policy tags from the Data Catalog to apply masking rules (e.g., email mask, last-four, hash) at the column level, and access to the unmasked data is controlled via IAM roles on the taxonomy. This lets the 'support' group see masked emails while managers with the fine-grained reader role see full values, all without duplicating data.

Answer

Create a view that applies masking functions and grant access to the view.

Answer

Use Cloud DLP to scan and de-identify the data in place.

Answer

Create separate tables for each role and populate them with appropriate data.