Google PCA Design for security and compliance Practice Question
A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?
⚠ Common exam trap
Watch out — candidates often confuse the key management options (CMEK vs. CSEK vs. default encryption) and the security analytics tools (Security Command Center vs. Chronicle), where candidates often pick Security Command Center for anomaly detection when Chronicle is specifically designed for log-based threat detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle
Cloud Storage with CMEK via Cloud KMS allows the organization to use a customer-managed key that can be rotated every 90 days, meeting the compliance requirement. Cloud Audit Logs capture all access to the bucket, and Chronicle provides advanced security analytics to detect anomalous access patterns, fulfilling the logging and detection needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center
Why it's wrong here
Default encryption uses Google-managed keys, not customer-managed, so rotation is not under customer control.
- ✗
Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP
Why it's wrong here
Cloud DLP is for data loss prevention, not anomaly detection.
- ✗
Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center
Why it's wrong here
CSEK keys are not managed via Cloud KMS and cannot be rotated automatically; they are supplied per request.
- ✓
Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle
Why this is correct
CMEK uses Cloud KMS for key management, Cloud Audit Logs for logging, and Chronicle for anomaly detection.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.