hardMultiple SelectObjective-mapped
PCSE Practice Question: Comply with the General Data Protection…
A company needs to comply with the General Data Protection Regulation (GDPR). They are using BigQuery to store personal data. Which THREE measures should they implement to meet GDPR requirements?
⚠ Common exam trap
Google Cloud often tests the misconception that encryption (like Cloud KMS) is a primary GDPR measure for BigQuery, when in reality BigQuery's default encryption already meets encryption requirements, and the focus should be on access control, auditability, and data lifecycle management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable audit logs via Cloud Audit Logs to track access to personal data.
Cloud Audit Logs provide a comprehensive, immutable record of all administrative and data access activities in BigQuery, which is essential for demonstrating GDPR compliance through accountability and traceability. By enabling audit logs, the company can track who accessed personal data, when, and from where, fulfilling the GDPR requirement to maintain records of processing activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable audit logs via Cloud Audit Logs to track access to personal data.
Why this is correct
Audit logs are necessary for demonstrating compliance.
- ✗
Use Cloud KMS to encrypt individual columns containing personal data.
Why it's wrong here
BigQuery does not support column-level encryption; Cloud DLP is used for de-identification.
- ✗
Store data in a multi-region location like 'EU' to ensure availability across regions.
Why it's wrong here
GDPR does not require multi-region; data can be stored in a single region.
- ✓
Use Cloud DLP to classify and de-identify sensitive columns before loading into BigQuery.
Why this is correct
Cloud DLP helps identify and protect personal data.
- ✓
Enable data deletion by using DML statements to remove personal data when requested.
Why this is correct
GDPR's right to erasure requires the ability to delete personal data.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.