Designing for security and compliance — PCA Practice Quiz

Question 1

A financial services company must satisfy a regulator's requirement that any access to their data by the cloud provider's support and engineering staff be logged, justified, and subject to explicit customer approval before the access occurs. The compliance team also wants near-real-time visibility into these provider-initiated access events. Which combination of Google Cloud capabilities best satisfies this requirement?

Accepted Answer

Enable Access Transparency logs and configure Access Approval to require explicit customer approval for Google support access.

Answer

Enable Cloud Audit Logs (Admin Activity and Data Access) and rely on them to capture Google staff access.

Answer

Apply VPC Service Controls perimeters around all data resources and enable Access Context Manager policies.

Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud HSM so Google cannot access the data without customer keys.

Question 2

A US-based defense contractor is migrating a workload to Google Cloud that must comply with FedRAMP High and IL4 requirements. The security team mandates that the environment enforce data residency in US regions, restrict Google support personnel to US persons, and continuously monitor for configuration drift away from the compliance baseline. They want a Google-managed solution that packages these controls rather than assembling individual org policies and IAM constraints manually. Which approach best meets these requirements?

Accepted Answer

Deploy the workload into an Assured Workloads environment configured for the FedRAMP High / IL4 compliance regime

Answer

Create a folder and apply org policy constraints for resource location, plus custom monitoring scripts to detect drift

Answer

Enable VPC Service Controls perimeters around all projects and rely on Access Transparency logs for support personnel tracking

Answer

Purchase a dedicated Cloud Interconnect and host the workload in a Sovereign Controls partner region

Question 3

A financial services company runs microservices on GKE and must satisfy an auditor requirement that only container images built and scanned by the approved CI/CD pipeline can be deployed to production clusters. Developers must not be able to run arbitrary or manually pushed images. Which Google Cloud approach best enforces this control at deploy time?

Accepted Answer

Enable Binary Authorization on the production clusters with a policy requiring attestations signed by the trusted build and scan attestors before any image can be deployed.

Answer

Restrict IAM so that only the CI/CD service account has the Kubernetes Engine Developer role on the production namespace.

Answer

Enable vulnerability scanning in Artifact Registry and configure alerts when images with critical CVEs are pushed.

Answer

Use a VPC Service Controls perimeter around the GKE clusters to prevent images from outside the organization being pulled.

Question 4

A financial services company must generate and store the cryptographic signing keys used for their digital document-signing service. Regulatory auditors require that all key material be generated and stored in hardware validated to FIPS 140-2 Level 3, and the company wants to avoid managing physical hardware while still using Cloud KMS APIs. Which Google Cloud solution meets these requirements with the least operational overhead?

Accepted Answer

Use Cloud HSM to create hardware-backed keys, which are generated and stored in FIPS 140-2 Level 3 validated HSMs managed by Google.

Answer

Use Cloud KMS software-protected keys and enable automatic key rotation to satisfy the auditors.

Answer

Deploy your own HSM appliances on Compute Engine VMs and integrate them with Cloud KMS via a custom connector.

Answer

Use Cloud External Key Manager (EKM) to store keys with a third-party key management partner outside Google Cloud.

Question 5

A financial services company stores all encryption keys in a dedicated 'security-keys' project managed by the central security team. An application team's project runs Compute Engine VMs whose persistent disks must be encrypted with a customer-managed encryption key (CMEK) from a key ring in the security-keys project. When the application team tries to create a disk referencing the key, disk creation fails with a permission error. What is the correct way to resolve this while maintaining centralized key management?

Accepted Answer

Grant the Compute Engine service agent of the application project the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key or key ring in the security-keys project.

Answer

Copy the CMEK material from the security-keys project into the application project's own key ring so the service agent can access it locally.

Answer

Grant the application team's users the Cloud KMS Admin role on the security-keys project so they can manage the key during disk creation.

Answer

Disable CMEK for the disks and rely on Google-managed default encryption, then re-enable CMEK once IAM propagates.

Question 6

A financial services company stores customer records in Cloud Storage buckets encrypted with customer-managed encryption keys (CMEK) in Cloud KMS. To comply with a data protection regulation, when a customer requests deletion of their data, the company must guarantee that all copies—including any that may persist in backups or replicated storage—become permanently unrecoverable, and must be able to prove the data is cryptographically inaccessible. What is the most effective approach to meet this requirement?

Accepted Answer

Store each customer's data under a dedicated CMEK key and destroy that key version in Cloud KMS when the customer requests deletion (crypto-shredding).

Answer

Delete the customer's objects from the bucket and rely on Cloud Storage soft delete and object versioning to purge older copies after the retention window.

Answer

Rotate the single shared CMEK key used for all customers so the old key version is no longer primary, then delete the customer's objects.

Answer

Disable the CMEK key temporarily and set an object lifecycle rule to delete the customer's objects after 30 days.

Question 7

A multinational bank must store customer records in Cloud Storage and BigQuery. A new regulatory requirement mandates that the bank retain sole control of the encryption keys outside of Google Cloud, so that Google can never access key material even under a lawful access request. The security team also needs the ability to instantly and permanently revoke Google's ability to decrypt the data. Which encryption approach satisfies these requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with keys held in an approved external key management partner controlled by the bank.

Answer

Use Google-managed default encryption and rely on Google's data residency guarantees for the region.

Answer

Use customer-managed encryption keys (CMEK) with keys stored in Cloud KMS in the same region as the data.

Answer

Use customer-supplied encryption keys (CSEK) uploaded to Cloud KMS and rotated automatically by Google.

Question 8

A financial services company stores highly sensitive customer records in Cloud Storage buckets encrypted with Cloud KMS customer-managed encryption keys (CMEK). Regulators require that any decryption of this data by cloud provider personnel or automated processes be explicitly justified and, in certain cases, blocked unless the organization approves the reason. The security team wants a mechanism where each request to use the key includes a reason code, and the organization can define policies that automatically deny key access for unapproved justification categories. Which capability should the architect implement?

Accepted Answer

Enable Key Access Justifications (KAJ) on the CMEK keys and configure a justification policy that denies unapproved reason codes.

Answer

Turn on Access Transparency logs and manually review each key-usage entry after the fact.

Answer

Rotate the CMEK keys more frequently and restrict IAM roles on the key ring to a small group.

Answer

Move the keys to Cloud HSM and enable audit logging on the key ring.

Question 9

A financial services company must comply with a regulation requiring that the team managing encryption keys be different from the team that operates the applications consuming those keys. Application workloads run on Compute Engine and store data in Cloud Storage encrypted with Cloud KMS. Security auditors require proof that developers cannot administer or destroy keys, while applications can still perform encrypt/decrypt operations. Which IAM design best satisfies these separation-of-duties requirements?

Accepted Answer

Grant the security team the Cloud KMS Admin role on the key ring and grant the application service accounts the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific keys.

Answer

Grant both the security team and the application service accounts the Cloud KMS Admin role, and rely on audit logs to detect misuse after the fact.

Answer

Grant developers the Owner role on the project so they can manage keys and applications together, and enable Cloud Audit Logs for key operations.

Answer

Grant the application service accounts the Cloud KMS Admin role and grant the security team the Cloud KMS CryptoKey Encrypter/Decrypter role for oversight.

Question 10

A defense contractor must store classified project data in Google Cloud but is contractually required to retain sole physical custody of all encryption keys, with keys never leaving their on-premises hardware security module. They also need the ability to instantly revoke Google's access to the plaintext data by cutting off key access, and they must prove that Google cannot decrypt data without their live authorization. Which key management approach satisfies these requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) to reference keys hosted in the contractor's on-premises external key management system.

Answer

Use Cloud KMS with customer-managed encryption keys (CMEK) generated and stored inside Google's Cloud HSM.

Answer

Import the contractor's key material into Cloud KMS and enable automatic key rotation with a short rotation period.

Answer

Rely on Google-managed default encryption at rest and enable Access Transparency logs to audit Google's data access.

Question 11

A financial services company ingests customer support chat transcripts into a BigQuery dataset used by data analysts to build product improvement dashboards. Compliance requires that analysts must never see raw personally identifiable information (PII) such as credit card numbers, national IDs, and email addresses, but the analytics must remain useful (aggregations, trends). The security team wants a scalable, managed approach that transforms the sensitive fields before analysts query them, while preserving the ability to correlate records. What should the architect recommend?

Accepted Answer

Use Sensitive Data Protection (Cloud DLP) to inspect and de-identify the data using format-preserving encryption/tokenization before or during load into an analyst-accessible BigQuery dataset.

Answer

Grant analysts the BigQuery Data Viewer role only during business hours and rely on Cloud Audit Logs to detect any misuse of PII.

Answer

Store the raw transcripts in a Cloud Storage bucket with CMEK encryption and give analysts read access to the bucket instead of BigQuery.

Answer

Apply BigQuery column-level IAM to hide PII columns entirely, removing them from all analyst queries.

Question 12

A financial services company is drafting a security whitepaper for auditors. The auditors ask how Google Cloud protects customer data stored in Cloud Storage and Persistent Disk by default, without the customer configuring anything. The architect must accurately describe the default encryption-at-rest mechanism. Which statement correctly describes Google Cloud's default data-at-rest encryption?

Accepted Answer

Data is automatically encrypted at rest using AES-256 with a key hierarchy in which data encryption keys (DEKs) are wrapped by key encryption keys (KEKs) stored in Google's internal KMS, requiring no customer action.

Answer

Data is only encrypted at rest if the customer enables Customer-Managed Encryption Keys (CMEK) in Cloud KMS; otherwise the data is stored in plaintext.

Answer

Data is encrypted at rest only when Customer-Supplied Encryption Keys (CSEK) are provided in each API request, and Google discards the key after the operation.

Answer

Data is protected at rest solely through VPC Service Controls perimeters and IAM policies rather than cryptographic encryption.

Question 13

A financial services company stores sensitive customer statements in Cloud Storage buckets. During a security review, auditors find that individual objects have inconsistent legacy ACLs, making it impossible to reason about who can access data at scale. The security team wants to enforce access exclusively through IAM policies at the bucket level and eliminate per-object ACLs going forward, while ensuring the setting cannot be casually reverted by bucket owners. What should the architect recommend?

Accepted Answer

Enable uniform bucket-level access on the buckets and apply an organization policy constraint that enforces uniform bucket-level access on all new buckets.

Answer

Manually audit and remove all object ACLs weekly using a scheduled Cloud Function, keeping fine-grained access mode enabled.

Answer

Grant the Storage Object Viewer role to a single group and rely on signed URLs for all downstream object access.

Answer

Enable object versioning and turn on data access audit logs so ACL changes are recorded for later review.

Question 14

A European retail company stores customer profiles and purchase history in Cloud Storage and BigQuery. Under GDPR, customers can submit a 'right to erasure' request requiring the company to delete all their personal data across systems within a defined timeframe. The architect needs a design that guarantees a specific individual's data can be located and permanently removed on demand, while keeping the deletion process auditable. Which approach best supports this compliance requirement?

Accepted Answer

Tag or index all records with a consistent customer identifier, maintain a data map of every location containing personal data, and implement automated deletion jobs that remove or overwrite those records, logging each action to a tamper-evident audit sink.

Answer

Rely on Cloud Storage Object Lifecycle Management to automatically delete all objects after a fixed retention period so personal data is eventually purged.

Answer

Enable CMEK on all buckets and datasets so that data can be rendered inaccessible for individual customers by rotating the encryption key.

Answer

Move all personal data to a single EU region using Organization Policy resource location constraints, ensuring GDPR compliance through data residency alone.

Question 15

A financial services company runs sensitive workloads on a Google Kubernetes Engine (GKE) Standard cluster. During a compliance audit, the security team learns that Kubernetes Secrets (containing API tokens and database passwords) are stored in etcd only base64-encoded, not encrypted with a key the company controls. Regulators require that any at-rest secret material be protected by a customer-managed encryption key with the ability to disable access. What should the architect implement to meet this requirement with the least operational overhead?

Accepted Answer

Enable application-layer secrets encryption on the GKE cluster using a Cloud KMS key (CMEK) to envelope-encrypt Kubernetes Secrets in etcd.

Answer

Migrate all secrets out of Kubernetes and require every pod to fetch them at startup from Secret Manager over the internet.

Answer

Rely on GKE's default Google-managed encryption at rest for etcd, since all data on persistent disks is already encrypted.

Answer

Deploy a HashiCorp Vault cluster inside GKE and store its unseal keys as Kubernetes Secrets to protect the other secrets.

Question 16

A healthcare startup is building a patient-record analytics platform on Google Cloud and must comply with HIPAA. Their compliance officer wants to ensure that every Google Cloud product used to store, process, or transmit electronic protected health information (ePHI) is legally permitted under HIPAA. As the cloud architect, what is the correct first step to establish this compliance foundation?

Accepted Answer

Execute the Business Associate Agreement (BAA) with Google and restrict the architecture to products that Google lists as covered under the BAA.

Answer

Enable Customer-Managed Encryption Keys (CMEK) on all services, which automatically makes any Google Cloud product HIPAA-compliant.

Answer

Purchase an Assured Workloads folder configured for the HIPAA control package, which grants legal HIPAA coverage for all Google services.

Answer

Submit a support case requesting a third-party HITRUST audit report and rely on it as the binding compliance agreement for ePHI handling.

Question 17

A financial services company runs a Google Cloud project containing production BigQuery datasets. During quarterly audits, external auditors require read-only access to specific datasets, but only for a two-week window each quarter. The security team wants to grant this access without manually revoking it afterward, without creating standing permissions, and while maintaining least privilege. What is the most appropriate way to grant this access?

Accepted Answer

Grant the auditors the BigQuery Data Viewer role with an IAM Condition that limits the binding to the specific date/time range of the audit window.

Answer

Add the auditors to a Google Group that has the BigQuery Data Viewer role, and rely on a calendar reminder to remove them after two weeks.

Answer

Grant the auditors the BigQuery Admin role at the project level so they can access all datasets, then delete the binding when the audit ends.

Answer

Create a service account with the BigQuery Data Viewer role and share its key with the auditors for the duration of the audit.

Question 18

A financial services company must grant its internal audit team the ability to read configuration and metadata across all projects in an organization to verify controls, but auditors must never be able to modify resources or read customer data. The security team wants to avoid over-provisioning that comes with broad predefined roles. Which approach best follows least-privilege while satisfying the auditors' need for org-wide read visibility?

Accepted Answer

Grant the auditors the Security Reviewer (roles/iam.securityReviewer) role plus a custom role containing only the specific metadata and configuration read permissions they need, bound at the organization level.

Answer

Grant the auditors the predefined Viewer (roles/viewer) role at the organization level so they inherit read access to every project.

Answer

Grant the auditors the Organization Administrator role but attach an IAM deny policy blocking write operations.

Answer

Create a shared service account with Editor at the org level and have all auditors download and use its key for read operations.

Question 19

A financial services company grants broad Editor roles to several project owners for agility. The security team must ensure that, regardless of any IAM allow bindings, no principal outside the company's security group can ever delete Cloud KMS keys or key versions across the entire organization — even if a project owner mistakenly grants such permissions. Which approach best enforces this organization-wide restriction?

Accepted Answer

Create an IAM deny policy at the organization node that denies the cloudkms.cryptoKeyVersions.destroy and related permissions to all principals except members of the security group

Answer

Remove all Editor role bindings and replace them with custom roles that exclude KMS delete permissions in every project

Answer

Configure an organization policy constraint to restrict KMS key deletion across all projects

Answer

Enable VPC Service Controls around all projects containing Cloud KMS keys to block delete operations

Question 20

A security review at a financial services company reveals that many members have been granted broad predefined roles like roles/editor on production projects, but most only use a small subset of permissions. Leadership wants a data-driven, ongoing process to safely reduce these members to least privilege without breaking active workloads. Which Google Cloud approach best meets this requirement?

Accepted Answer

Use IAM Recommender to review policy insights and recommendations based on 90-day usage data, and apply the suggested smaller roles for over-permissioned members.

Answer

Replace all predefined roles with a single custom role that contains every permission any member might need, then assign it project-wide.

Answer

Remove all IAM bindings and re-grant access manually as each member files a support ticket requesting specific permissions.

Answer

Apply an organization policy constraint that blocks the use of the roles/editor role across all projects.

More PCA practice