CCNA Pcse Data Protection Questions

BigQuery column-level security using policy tags and data masking rules allows you to define fine-grained access controls and masking policies on specific columns. This is the recommended approach for column-level access and masking in BigQuery.

To meet the requirements: 1) Set rotation period to 30 days on the key; 2) Do not destroy old key versions until after 6 months; 3) The default destruction policy does not automatically destroy old versions, so they remain available. Setting a primary version is not required for rotation, and disabling rotation is contrary.

Option D is correct because Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.

Option C is correct because Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Access Transparency provides logs when Google personnel access customer content (e.g., support cases, internal troubleshooting). These logs are near-real-time and can be viewed in Cloud Logging. Audit Logs (Cloud Audit Logs) record user API calls, not Google admin access.

CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace data with a token that retains the original format and length, and the process is reversible with the encryption key.

To scan objects automatically upon upload, you need a Cloud DLP job trigger that listens to Pub/Sub notifications from the storage bucket. The bucket must be configured to send Pub/Sub notifications for new objects. The job trigger will create inspect jobs when new objects are added.

The 'gcp.resourceLocations' constraint restricts the locations where resources can be created. By setting the allowed locations to 'us' (or specific US regions), BigQuery datasets must be created in those locations. The other constraints: 'constraints/bigquery.restrictDatasetLocation' is not a valid organization policy. 'constraints/gcp.restrictNoncompliantResources' is not specific to locations. 'constraints/compute.trustedImageProjects' is for images.

To use CMEK with Cloud HSM, the engineer needs to create a Cloud HSM key ring (which is a resource that groups keys) and a cryptographic key with protection level HSM. The key ring is created first, then the key is created within it. The other options: a key ring with software protection level would not use HSM; a Cloud KMS key is created within a key ring, so both are needed.

To switch a key from software to HSM backend, you need to create a new key version with the protection level HSM, and then update the key's default protection level to HSM so that future versions are also HSM-backed. You cannot change the protection level of an existing key version.

The organization policy constraint gcp.resourceLocations restricts the locations where Google Cloud resources can be created. By setting a list of allowed locations (e.g., europe-west1, europe-west4), resources cannot be created in non-EU regions.

Option A is correct because CSEK keys are not stored in Google Cloud; they are provided by the customer at the time of disk attachment. To rotate the key, you must detach the disk and reattach it with the new CSEK key, as the key is only used during the attach operation to encrypt the disk's data encryption keys (DEKs). The disk itself is not re-encrypted; the new key is used to wrap the DEKs for future reads/writes.

The organization policy constraint gcp.resourceLocations restricts the locations where resources can be created. By setting this constraint with a list of allowed locations (e.g., europe-west1), new buckets can only be created in those regions.

Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.

DLP job triggers can be configured to scan on schedule or in response to events. However, scanning only new objects requires using Cloud Storage object change notification or setting up a trigger that scans incrementally. The best approach is to create a DLP job trigger that scans based on Cloud Storage events (e.g., via Pub/Sub) for new objects.

Cloud DLP uses 'DlpJob' or 'InspectJob' to scan data. A 'DlpJob' can be created to inspect content in Cloud Storage, BigQuery, or Datastore. A job trigger can schedule scans, but the scan itself is a job. 'DeidentifyTemplate' and 'InspectTemplate' are configuration templates, not the scan execution.

CryptoReplaceFfxFpeConfig performs format-preserving encryption, suitable for credit card numbers. MaskingConfig with a 'x' character can mask email addresses (e.g., first character visible).

BigQuery column-level security with data masking rules (via BigQuery Data Policy) allows defining masking policies (e.g., email masking, hash masking) that are automatically applied to query results based on user IAM. DLP inspection can identify the sensitive columns, but the masking is enforced by BigQuery policies.

Option A is correct because Cloud DLP allows you to define custom infoTypes using regular expressions to match patterns not covered by built-in infoTypes. By creating a custom infoType with a regex pattern like `\+1-\d{3}-\d{3}-\d{4}`, the DLP job can inspect Cloud Storage buckets for phone numbers in the specified format. This approach directly addresses the requirement without relying on external services or unsupported built-in types.

The constraint 'gcp.resourceLocations' restricts where Google Cloud resources can be created. It can be set to a list of allowed locations. The other constraints: 'iam.allowedPolicyMemberDomains' restricts member domains, 'compute.skipDefaultNetworkCreation' prevents default network creation, 'constraints/compute.trustedImageProjects' restricts image projects.

Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Cloud HSM is a managed hardware security module (HSM) service that provides FIPS 140-2 Level 3 validated security for cryptographic keys. It allows you to generate, store, and manage keys in a tamper-resistant hardware device.

CSEK (Customer-Supplied Encryption Keys) allows you to provide your own keys with each API call, and Google does not store them. This meets the requirement that Google never has access to key material.

Customer-Managed Encryption Keys (CMEK) combined with Cloud HSM allow customers to manage their own keys in a FIPS 140-2 Level 3 validated HSM. Google-managed keys do not give customer control, and Customer-Supplied Encryption Keys (CSEK) require the customer to supply the key with each API call and Google does not store the key, which is impractical for many use cases and does not use HSM.

When a key version is destroyed, it enters a 24-hour pending destruction period. During this time, it can be restored. After 24 hours, destruction is permanent and irreversible.

Cloud KMS offers HSM keys that are generated and protected within an FIPS 140-2 Level 3 certified HSM. When a company requires FIPS 140-2 Level 3 compliance, the only key type that meets this requirement is an HSM key, regardless of its purpose (e.g., symmetric encryption, asymmetric signing). Software keys, even with any purpose, only meet FIPS 140-2 Level 1.

The `gcp.resourceLocations` organization policy constraint is the correct mechanism to restrict where resources can be created in Google Cloud. By setting this list constraint at the organization or folder level, you can specify allowed locations (e.g., EU regions), and any attempt to create a resource outside those regions will be denied. This directly enforces GDPR data residency requirements without relying on IAM roles or service-specific configurations.

Option A is correct because BigQuery's policy tags with data masking rules allow you to define column-level masking policies. By creating a masking rule that reveals only the last four digits of the credit card number, you can grant the `data_scientist` role MASKED access (which applies the mask) and the `data_owner` role UNMASKED access (which bypasses the mask). This approach enforces column-level security without duplicating data or using row-level filters.

Secret Manager supports automatic rotation with a specified rotation period and Pub/Sub notifications. A Cloud Function can listen for the notification and generate a new password, updating the secret version.

Option A is correct because Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Cloud KMS offers two protection levels: software and HSM. HSM protection level uses Cloud HSM, which is FIPS 140-2 Level 3 validated. Software keys are validated to Level 1.

To access a secret version's payload (the actual secret value), the permission 'secretmanager.versions.access' is required. The role 'roles/secretmanager.secretAccessor' includes this permission. The other permissions are for listing or managing metadata.

Option B is correct because a Cloud DLP job is required to orchestrate the scanning and transformation of data. It must reference both a job trigger (to start the job when new objects are uploaded) and an inspection template (to define what to look for, such as credit card numbers). Without the job, the trigger and templates cannot execute the de-identification workflow.

BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Assured Workloads provides compliance controls for ITAR (among others) and can enforce data residency within the US. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for encryption keys. Together they satisfy both requirements.

Cloud DLP job triggers can be configured to scan Cloud Storage buckets on a schedule or event-driven (e.g., via Cloud Storage Pub/Sub notifications). The trigger will inspect objects for sensitive data and log results. This meets the requirement for automatic scanning.

Customer-Managed Encryption Keys (CMEK) using Cloud KMS allow customers to manage their own key material and configure automatic rotation (minimum 24h, but typically set to 90 days). GMEK is Google-managed (no customer control), CSEK requires customer to supply key with each API call (Google never stores it), and Cloud HSM is a key management service but still uses CMEK integration for rotation.

Assured Workloads provides a folder with specific compliance controls. The organization policy constraint gcp.resourceLocations restricts resource creation to allowed regions. The folder itself is created in a specific location (e.g., eu) to enforce the boundary.

BigQuery column-level security with policy tags allows classification, and BigQuery Data Policy with data masking rules (like email masking) applies dynamic masking at query time.

To enable automatic rotation, you need to configure a rotation period and a Pub/Sub topic. The rotation period defines how often the secret is rotated, and the Pub/Sub topic is used to notify the Cloud Function when rotation is due.

Access Transparency provides near-real-time logs when Google staff access customer content, offering visibility into administrative actions.

Cloud DLP can inspect data for sensitive info types. DLP job triggers allow scheduling recurring scans of Cloud Storage, BigQuery, or Datastore. The trigger runs the inspection job based on a schedule.

Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Cloud DLP InfoType detectors are used to identify specific types of sensitive data. CREDIT_CARD_NUMBER is a built-in detector that finds credit card numbers in text or files.

The ENCRYPT_DECRYPT purpose is for symmetric encryption/decryption. ASYMMETRIC_SIGN is for digital signing, ASYMMETRIC_DECRYPT is for asymmetric decryption (e.g., using RSA), and MAC is for message authentication codes.

Assured Workloads provides regulatory compliance controls, including support for ITAR. It helps enforce data residency and access controls required for ITAR workloads.

Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own encryption keys with each API call. Google never stores these keys, ensuring the customer retains full control. GMEK and CMEK involve Google storing the keys, and Cloud HSM is a managed service that stores keys, so none meet the 'not stored by Google' requirement.

BigQuery column-level security uses: a Data Catalog taxonomy to define policy tags, a BigQuery Data Policy that specifies masking rules (e.g., hash, nullify) associated with the policy tag, and IAM roles (e.g., BigQuery Masked Reader) to grant access to masked data. The taxonomy contains the policy tags, the data policy defines the masking rule, and IAM controls who sees masked vs. plaintext.

When a key version is disabled and scheduled for destruction, there is a 24-hour pending destruction grace period by default. During this time, the key can be restored. After 24 hours, the key version is permanently destroyed.

CSEK (Customer-Supplied Encryption Keys) allows you to provide your own key with each API call, and Google never stores the key. This is appropriate for on-premises HSM integration.

CryptoReplaceFfxFpeConfig performs format-preserving encryption (FPE), which can replace a value with a token that retains the format, such as last 4 digits visible.

Access Transparency logs are only generated for services that support Access Transparency and have the feature enabled. At the time of writing, not all GCP services support Access Transparency. If the missing logs are for unsupported services, they will not appear.

The correct role is roles/secretmanager.secretAccessor because it grants the specific permission secretmanager.versions.access required to read the secret payload from Secret Manager. The default Compute Engine service account needs only this minimal permission to retrieve the secret value, following the principle of least privilege.

When a key version is scheduled for destruction, it enters a pending destruction grace period. The default grace period is 24 hours, during which the destruction can be canceled. After that, the key material is destroyed and unrecoverable.

Secret Manager is designed for storing secrets such as API keys and database credentials. It supports versioning, IAM roles with fine-grained access (e.g., secretmanager.versions.access), and automatic rotation via Pub/Sub notifications triggering Cloud Functions.

Secret Manager is purpose-built for storing secrets like API keys, certificates, and database passwords. It provides versioning, IAM policies (e.g., secretmanager.versions.access), and automatic rotation with Pub/Sub notifications.

Access Transparency provides near-real-time logs of actions taken by Google personnel when accessing customer content. It is part of the Assured Workloads offering and can be enabled for supported services.