Professional Cloud Security Engineer

Question 1

A financial services company operating under strict regulatory requirements must ensure that no Google support or engineering personnel can access their customer data unless the company's own security team has explicitly granted permission for each access request. They already have Access Transparency logs enabled but want to move from passive visibility to active pre-authorization. Which capability should they configure to meet this requirement?

Accepted Answer

Enable Access Approval so that a designated approver in the organization must grant explicit consent before Google personnel can access covered resources

Answer

Configure Key Access Justifications with a policy that automatically denies all unjustified key access requests

Answer

Enable Data Access audit logs for all services so that every read of customer data is recorded for review

Answer

Deploy an Assured Workloads folder to restrict Google support personnel to in-region staff only

Question 2

A financial services company must document to their auditors that all Google personnel access to their production data is logged. Their compliance team wants to enable Access Transparency logs across the organization. During the enablement review, the security engineer discovers that Access Transparency is not available to activate for the organization. What is the most likely prerequisite the company has not met?

Accepted Answer

The organization does not have a qualifying support level such as Premium, Enhanced, or Platinum Support (or equivalent role-based support).

Answer

Data Access audit logs have not been enabled for all services in the organization.

Answer

The organization has not deployed an Assured Workloads folder for regulated data.

Answer

Access Approval has not been configured to require approval before support access.

Question 3

A financial services company is preparing documentation for an external auditor who is assessing the organization's ability to demonstrate oversight of any Google personnel access to customer content. The security team has already enabled Cloud Audit Logs (Admin Activity and Data Access). The auditor specifically asks for evidence showing when Google support or engineering staff accessed customer content, along with the justification for that access. Which action provides the required evidence?

Accepted Answer

Enable Access Transparency logs, which record actions taken by Google personnel on customer content, including the reason/justification for the access.

Answer

Enable Data Access audit logs for all services, since they capture every read and write of customer content including those performed by Google staff.

Answer

Configure Access Approval so that all Google personnel access is blocked, then export the denied-request records as audit evidence.

Answer

Create a log-based metric on Admin Activity logs to alert whenever a Google service account modifies IAM policy on customer resources.

Question 4

A financial services company must demonstrate to auditors that they have visibility into any actions Google Cloud support or engineering personnel take on their data, and that such access requires explicit organizational sign-off before it occurs. The compliance team has already enabled Access Transparency logs across the organization. During an audit rehearsal, they realize they cannot show evidence that Google personnel access was ever gated on their own approval. Which additional capability should they enable to meet the requirement that Google personnel access be explicitly authorized by the organization before it happens?

Accepted Answer

Access Approval, which requires the organization to grant explicit approval before Google personnel can access covered resources

Answer

Data Access audit logs, which record read and write operations performed on user data

Answer

Access Context Manager access levels that restrict console access to corporate IP ranges

Answer

Cloud Audit Logs Admin Activity logs, which capture configuration changes made by Google support

Question 5

A financial services company runs a CI/CD pipeline that pushes container images to Artifact Registry. Security requires that any image with a CRITICAL OS-package vulnerability must never be promoted to the production GKE cluster, while HIGH and below can proceed with tracking. The team already uses Binary Authorization with an attestor. What is the most effective way to automatically enforce this severity-based gate before deployment?

Accepted Answer

Enable Artifact Registry automatic vulnerability scanning, then use a Cloud Build step that queries the scan results via the Container Analysis API and only creates the Binary Authorization attestation when no CRITICAL vulnerabilities are found

Answer

Configure a GKE admission webhook that scans the running pod's filesystem at startup and evicts the pod if a CRITICAL vulnerability is detected

Answer

Rely on Security Command Center Container Threat Detection to alert the security team when a CRITICAL vulnerability is running, then manually delete the deployment

Answer

Set an Artifact Registry cleanup policy to automatically delete any image tagged with a CRITICAL vulnerability so it cannot be pulled by the cluster

Question 6

A healthcare organization runs regulated workloads in an Assured Workloads folder configured for a US-based compliance regime. During a routine audit, the compliance team must demonstrate to regulators that Google support and engineering personnel cannot access customer content without a documented business justification, and that any such access is logged with a reason code. Which capability should the team point to as evidence of this control?

Accepted Answer

Access Transparency logs combined with Access Approval, which record and gate Google personnel access with justification reason codes

Answer

Key Access Justifications (KAJ), which requires an approved justification reason before Google can use a CMEK key to decrypt data

Answer

Cloud Audit Logs Admin Activity entries, which capture all administrative API calls made by customer identities

Answer

VPC Service Controls perimeters, which prevent data exfiltration by blocking API access from outside the perimeter

Question 7

A healthcare company runs regulated workloads in an Assured Workloads folder configured for a specific compliance regime. The compliance team needs an automated way to be alerted when a resource is created or modified in a way that violates the Assured Workloads controls (for example, a resource deployed outside the approved region), so they can document and remediate the drift. Which capability should they use?

Accepted Answer

Enable Assured Workloads monitoring, which surfaces compliance violations (such as resource location or configuration drift) in the console and can generate findings for review and remediation

Answer

Rely on Access Transparency logs to detect when resources drift from the approved compliance configuration

Answer

Configure a Cloud DLP inspection job to scan resources and flag those that violate the compliance regime

Answer

Use Cloud Billing budget alerts to detect resources deployed outside approved regions

Question 8

A financial services company already runs several production projects in a Google Cloud organization. New regulations now require that a subset of these workloads meet a specific compliance regime with strict data residency and personnel access controls. The security team wants to bring these workloads under Assured Workloads with the least effort while ensuring compliance controls are actually enforced. What is the correct approach?

Accepted Answer

Create a new Assured Workloads folder for the required compliance regime and provision new projects within it, then migrate the regulated workloads into those projects.

Answer

Apply an organization policy constraint that restricts resource locations to the compliant regions on the existing projects, which retroactively converts them into Assured Workloads environments.

Answer

Enable the Assured Workloads API on each existing project so its current resources are automatically brought into scope for the compliance regime.

Answer

Move the existing projects unchanged into a standard folder and rely on Access Transparency logs to demonstrate compliance with the residency and personnel requirements.

Question 9

A healthcare company is deploying a new analytics platform on Google Cloud that must comply with a regional data sovereignty regulation requiring that all cryptographic key material be generated, stored, and controlled outside of Google's infrastructure and remain in the customer's jurisdiction. The security team has created an Assured Workloads folder configured for the appropriate compliance regime. During design review, an architect asks how encryption keys should be managed to satisfy the requirement that Google must never have access to unwrapped key material. Which approach should the team adopt?

Accepted Answer

Use CMEK backed by Cloud External Key Manager (EKM), storing keys in a supported third-party key management partner outside Google Cloud

Answer

Use CMEK backed by Cloud HSM in the same region, relying on FIPS 140-2 Level 3 hardware to isolate key material

Answer

Rely on Google-managed default encryption, since Assured Workloads already enforces data residency for the folder

Answer

Import externally generated keys into Cloud KMS using the key import feature so Google stores the wrapped versions

Question 10

A European financial services company must onboard to Google Cloud while meeting EU digital sovereignty requirements. Their legal team mandates that data storage and processing remain within EU boundaries, that Google support personnel access is restricted to EU-based staff, and that customer approval is required before any Google administrator can access data during support operations. Which approach best satisfies these compliance requirements with the least custom engineering effort?

Accepted Answer

Create an Assured Workloads folder using the 'EU Regions and Support' compliance regime, which enforces EU data residency and personnel controls, and enable Key Access Justifications with Access Approval for administrator access control.

Answer

Apply an organization policy list constraint restricting resource locations to EU regions and rely on default Access Transparency logs to review Google access after the fact.

Answer

Deploy resources into europe-west regions and configure VPC Service Controls perimeters to block all Google support access to the data.

Answer

Use CMEK with an external key manager (EKM) hosted in the EU and manually revoke keys whenever Google support activity is detected in audit logs.

Question 11

A U.S. federal contractor must run a new workload on Google Cloud under FedRAMP Moderate authorization. During planning, an engineer proposes using an Assured Workloads folder configured for the FedRAMP Moderate control package. A developer asks to deploy a Google Cloud service that is NOT on the list of products supported by that Assured Workloads compliance regime. What is the correct guidance for maintaining compliance within the Assured Workloads folder?

Accepted Answer

Only services in the Assured Workloads supported-products list for FedRAMP Moderate may be used in the folder; using an unsupported service risks violating the compliance controls and should be avoided or flagged by the org policy restrictions Assured Workloads applies.

Answer

Assured Workloads will automatically bring the unsupported service into scope, so it can be used freely once deployed inside the folder.

Answer

Enable Access Transparency on the project, which retroactively certifies any service for FedRAMP Moderate.

Answer

Grant the developer a custom IAM role scoped to the unsupported service, which satisfies FedRAMP Moderate personnel controls.

Question 12

A US federal contractor must run a new workload in Google Cloud that handles Controlled Unclassified Information (CUI). Compliance requires that the data remain within US regions, that only US-based Google support personnel who have passed government background checks can access the environment, and that the control package aligns with the DoD Impact Level 4 (IL4) framework. The security team wants Google to enforce these constraints programmatically at folder creation rather than relying on manually applied org policies. What should they do?

Accepted Answer

Create an Assured Workloads folder using the DoD IL4 compliance regime, then deploy the workload resources into projects within that folder.

Answer

Apply a resource location org policy constraint restricting all resources to US regions and enable Access Transparency logs on the projects.

Answer

Enable VPC Service Controls with an access level requiring US corporate IP ranges, and configure CMEK with keys stored in US regions.

Answer

Purchase a Google Cloud premium support plan that guarantees US-based support engineers, then apply data residency org policies manually.

Question 13

A financial services company must demonstrate to auditors that all administrative configuration changes to Google Cloud resources over the past 18 months can be produced on demand. The compliance team discovers that Admin Activity audit logs are being relied upon for this evidence, but is concerned they will not satisfy the 18-month retention requirement. Which action correctly addresses this concern while minimizing operational overhead?

Accepted Answer

Admin Activity logs are retained by default for 400 days, so create a log sink that routes them to a log bucket or Cloud Storage with an 18-month retention policy

Answer

Enable Data Access audit logs for all services, since Admin Activity logs are only retained for 30 days

Answer

Manually export the _Required log bucket contents each week to a spreadsheet to preserve them beyond their default 30-day retention

Answer

Disable the _Required bucket and create a new default bucket with a custom retention period to capture Admin Activity logs

Question 14

A financial services company must be able to prove exactly which principals read the contents of sensitive objects in a specific Cloud Storage bucket during forensic investigations. During a recent incident, the security team discovered that Cloud Logging showed no records of object reads, only administrative changes to the bucket configuration. They need read operations to be captured going forward with minimal blast radius. What should the team configure?

Accepted Answer

Enable Data Access audit logs for the DATA_READ log type on the Cloud Storage service, scoping the configuration to the relevant project or resource.

Answer

Rely on Admin Activity audit logs, which are enabled by default and record all access to Cloud Storage objects.

Answer

Create a log-based metric on Admin Activity logs to alert whenever an object is downloaded from the bucket.

Answer

Enable VPC Flow Logs on the subnet used by clients accessing the bucket to capture object read activity.

Question 15

A financial services company must demonstrate to auditors that all reads and writes to a specific set of BigQuery datasets holding regulated customer data are logged, without incurring the cost and volume of enabling Data Access logs across every service in the organization. Their compliance mandate applies only to those datasets. What is the recommended approach to configure Data Access audit logs to satisfy this requirement efficiently?

Accepted Answer

Configure the IAM audit log settings to enable DATA_READ and DATA_WRITE for the BigQuery service scoped to the specific project containing the regulated datasets, and optionally use exempted members to reduce noise

Answer

Enable Data Access logs for the BigQuery service at the organization level and use log exclusion filters to drop everything except the regulated datasets

Answer

Rely on Admin Activity audit logs, which automatically capture all data read and write operations for regulated BigQuery datasets

Answer

Enable Access Transparency logs for the project, since they record all data access to customer data in the regulated datasets

Question 16

A compliance auditor asks your team to demonstrate which Cloud Audit Logs categories are always captured for a GCP organization without any administrator action to enable them, and which cannot be disabled. During a review, a security engineer claims that all audit log types must be explicitly enabled before they generate entries. Which statement correctly describes the default and configurability behavior of Cloud Audit Log types that you should document for the auditor?

Accepted Answer

Admin Activity and System Event logs are written by default and cannot be disabled, while Data Access logs (except BigQuery) are disabled by default and must be enabled.

Answer

All four audit log types (Admin Activity, System Event, Data Access, Policy Denied) are disabled by default and must be individually enabled in the organization's data access configuration.

Answer

Admin Activity logs are disabled by default but System Event and Data Access logs are always enabled and cannot be turned off.

Answer

Only Data Access logs are written by default; Admin Activity and System Event logs require enabling an audit configuration at the organization level.

Question 17

Your organization runs production workloads on a GKE cluster. Security policy requires that only container images built by the approved Cloud Build pipeline and scanned for vulnerabilities may be deployed. Developers must not be able to deploy arbitrary images pulled from public registries or built on their laptops. You need to enforce this at deploy time on the cluster. What should you implement?

Accepted Answer

Enable Binary Authorization on the cluster with a policy that requires attestations from the CI/CD attestor, and have Cloud Build create attestations only after successful vulnerability scanning.

Answer

Configure an Artifact Registry IAM policy that grants the developers only the Artifact Registry Reader role so they cannot push images.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry and configure Security Command Center to alert when a vulnerable image is deployed.

Answer

Apply a Pod Security Admission policy on the namespace that restricts images to a specific trusted registry hostname prefix.

Question 18

A company runs microservices on Cloud Run. The security team wants to guarantee that only container images built by the organization's trusted Cloud Build pipeline and stored in a specific Artifact Registry repository can be deployed to production Cloud Run services. Developers must not be able to deploy arbitrary public images. What is the most effective way to enforce this deployment control?

Accepted Answer

Enable Binary Authorization for Cloud Run and configure a policy requiring attestations from an attestor tied to the trusted build pipeline before any image can be deployed

Answer

Grant developers only the Cloud Run Viewer role so they cannot initiate deployments of untrusted images

Answer

Apply an organization policy constraint that restricts which external IP addresses Cloud Run services can egress to

Answer

Enable Artifact Registry vulnerability scanning and block deployment of any image with a CRITICAL CVE finding

Question 19

Your organization enforces a Binary Authorization policy on a GKE cluster requiring attestations from your CI/CD pipeline. A security review reveals a concern: images that passed admission weeks ago may later be found to contain newly disclosed vulnerabilities, but they continue running in the cluster because the policy is only evaluated at Pod creation time. The security team wants ongoing assurance that running Pods still comply with the Binary Authorization policy, and to be alerted when they drift out of compliance, without blocking currently running workloads. What should you do?

Accepted Answer

Enable Binary Authorization continuous validation, which periodically re-evaluates running Pods against the policy and records non-compliant Pods in Cloud Logging.

Answer

Configure the Binary Authorization policy enforcement mode to 'Dryrun Audit Log Only' so all admission decisions are logged for later review.

Answer

Add a cron job that deletes and recreates all Pods every hour so the admission controller re-evaluates each image against the current policy.

Answer

Enable GKE Container Threat Detection to monitor runtime behavior and flag Pods running vulnerable binaries.

Question 20

A media company serves static video thumbnails through a global external Application Load Balancer with Cloud CDN enabled. Their security team wants to filter requests based on source IP address and geographic region BEFORE any content is served from the CDN cache, so that malicious or out-of-region requests never reach cached or backend content. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach a Cloud Armor edge security policy to the backend service, using rules that match on source IP and region expressions

Answer

Attach a standard Cloud Armor backend security policy to the backend service and enable rate-based ban rules

Answer

Configure a Cloud Armor security policy on the URL map with a preconfigured WAF rule set

Answer

Apply VPC firewall rules that deny traffic from disallowed geographic IP ranges before it reaches the load balancer

Question 21

A retail company exposes a public web application through an external HTTP(S) load balancer. Recently, the application was targeted by SQL injection attempts and a volumetric flood of malicious requests from a handful of specific IP ranges. The security team wants to block the known bad IP ranges, mitigate common OWASP Top 10 attacks like SQL injection, and rate-limit abusive clients — all without modifying application code. Which approach should they implement?

Accepted Answer

Attach a Google Cloud Armor security policy to the load balancer backend service with deny rules for the IP ranges, preconfigured WAF rules for SQLi, and a rate-based ban rule.

Answer

Configure VPC firewall rules to deny the malicious IP ranges and enable Cloud NAT logging to detect SQL injection patterns.

Answer

Deploy Secure Web Proxy in front of the load balancer to filter inbound SQL injection traffic and enforce per-client rate limits.

Answer

Enable VPC Service Controls around the project and add the malicious IP ranges to an access level ingress deny list.

Question 22

A retail company exposes a public web application behind a global external Application Load Balancer. The security team must ensure that only traffic originating from the corporate offices' well-known egress IP ranges can reach the application, while all other public traffic is blocked at the network edge before hitting the backends. The list of corporate IP ranges is large and changes periodically as new offices open. Which approach best meets these requirements while minimizing maintenance overhead?

Accepted Answer

Attach a Cloud Armor security policy to the load balancer backend service with a default rule that denies traffic and a higher-priority allow rule that matches the corporate ranges using an address group referenced in the rule expression.

Answer

Create VPC ingress firewall rules on the backend instances that allow the corporate source ranges and deny 0.0.0.0/0, relying on the firewall to filter external client traffic.

Answer

Configure the load balancer's frontend forwarding rule to accept connections only from the corporate CIDR ranges specified directly in the forwarding rule configuration.

Answer

Enable Cloud NAT with a restricted set of external IPs and route all inbound application traffic through it so only corporate ranges are translated.

Question 23

A retail company runs a public API behind a global external Application Load Balancer. During flash sales, a small number of client IPs generate a massive volume of legitimate-looking requests that overwhelm backends, but the company does not want to fully block these clients — only slow them down when they exceed a fair usage threshold. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Create a Cloud Armor security policy rule with action 'throttle' using rate-based ban keyed on the client IP, setting a request threshold and enforcement interval.

Answer

Create a Cloud Armor security policy rule with action 'deny(429)' matching all requests from the source region.

Answer

Enable Cloud Armor adaptive protection and rely on its automatic Layer 7 DDoS mitigation to drop excess traffic.

Answer

Configure a Cloud CDN cache policy to serve cached responses so the backends never receive the excess requests.

Question 24

Your organization uses Cloud Build to deploy applications to production Cloud Run services. The security team requires that any deployment targeting the production environment must be manually reviewed and explicitly approved by an authorized release manager before it executes, while builds to staging should continue to run automatically. You need to implement this control natively within the CI/CD pipeline with an auditable record of who approved each production deployment. What should you do?

Accepted Answer

Configure a Cloud Build trigger for production with manual approval required, and grant the release managers the Cloud Build Approver role so they can approve pending builds.

Answer

Enable Binary Authorization on the production Cloud Run service and require the release manager to sign each container image with a KMS key before deployment.

Answer

Add a wait step in the production build configuration that pauses for 24 hours and send an email to the release manager asking them to cancel it if the deployment is not authorized.

Answer

Create a Pub/Sub notification on the production trigger and require the release manager to publish an approval message to the topic before the build proceeds.

Question 25

Your organization runs CI/CD pipelines in Cloud Build to deploy applications to Cloud Run. A recent security review found that the pipelines use the default Cloud Build service account, which has broad Editor-level permissions across the project. A malicious commit could therefore let a build step create resources or modify IAM policies far beyond deployment needs. The security team wants to reduce the blast radius of a compromised build while keeping deployments functional. What is the most appropriate action?

Accepted Answer

Configure Cloud Build to run with a dedicated user-managed service account granted only the roles required to deploy to Cloud Run, and remove the Editor role from the default service account.

Answer

Enable Binary Authorization on the Cloud Run service so only signed images can be deployed by the default service account.

Answer

Store the build steps in a private repository and restrict who can push commits using branch protection rules.

Answer

Grant the default Cloud Build service account the Security Admin role so it can manage its own IAM bindings during the build.

Question 26

A financial services company runs its container build pipeline in Cloud Build, pushing images to Artifact Registry. Auditors require cryptographic proof of how each image was built, including the source commit and build steps, so that downstream Binary Authorization policies can verify that images originate only from the trusted pipeline. The security team wants to enable this evidence with minimal custom tooling. What should they do?

Accepted Answer

Enable build provenance generation in Cloud Build so it produces SLSA-compliant provenance metadata for each image, and configure a Binary Authorization policy that requires attestations validated against that provenance.

Answer

Write a custom Cloud Function that hashes each built image and stores the hash in a BigQuery table for auditors to query manually.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry and rely on the CVE findings as proof of build origin.

Answer

Sign each image manually with a Cloud KMS asymmetric key from a developer workstation before pushing to Artifact Registry.

Question 27

A financial services company must comply with a regulatory requirement that all cryptographic keys protecting customer payment data be generated and stored in hardware validated to FIPS 140-2 Level 3. The security team wants to use Cloud KMS to manage these keys but must ensure the private key material never exists outside a certified hardware boundary and cannot be exported. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create keys in Cloud HSM (a key ring with the HSM protection level), which generates and stores key material in FIPS 140-2 Level 3 validated hardware security modules

Answer

Create keys in a Cloud KMS key ring using the software protection level and enable key rotation every 90 days

Answer

Generate keys on-premises in an HSM appliance and import the wrapped key material into Cloud KMS as external keys

Answer

Use customer-supplied encryption keys (CSEK) so the company retains full control of the raw key material

Question 28

A company uses Okta as its primary identity provider and Google Cloud with Cloud Identity for its cloud resources. The security team wants new employees added in Okta to be automatically created as Cloud Identity users, and departing employees to be automatically suspended in Cloud Identity when disabled in Okta — all without deploying or maintaining any server infrastructure on-premises. Which approach should they implement?

Accepted Answer

Configure automated user provisioning in Okta using the SCIM-based Google Cloud/Google Workspace provisioning integration to push user lifecycle changes to Cloud Identity

Answer

Deploy Google Cloud Directory Sync (GCDS) on a Compute Engine VM and schedule it to sync the Okta user directory to Cloud Identity

Answer

Enable SAML SSO between Okta and Cloud Identity, which automatically provisions and deprovisions users on each sign-in event

Answer

Write a custom script using the Directory API and run it as a cron job on an on-premises server to poll Okta and update Cloud Identity

Question 29

Your organization uses an on-premises Active Directory as the authoritative source for identities. You have deployed Google Cloud Directory Sync (GCDS) to provision users into Cloud Identity, and SSO is federated to your AD FS provider via SAML. An employee is terminated and their account is disabled in Active Directory. Security requires that this person can no longer authenticate to any Google Cloud resource. What is the correct outcome you should expect and configure to guarantee immediate loss of access?

Accepted Answer

Because SSO is federated, disabling the AD account alone blocks new sign-ins, but you should also suspend or delete the Cloud Identity user via GCDS and revoke existing OAuth/session tokens to terminate active sessions.

Answer

Deleting the user only in the Google Admin console is sufficient, because GCDS will detect the deletion and prevent re-creation on the next sync.

Answer

Removing all IAM role bindings for the user's email in the affected projects is the only step needed, since IAM policy fully controls authentication.

Answer

Rotating the SAML signing certificate in Cloud Identity will immediately invalidate the terminated user's access without affecting other users.

Question 30

A financial services company uses Cloud Identity as its identity provider and has hundreds of employees who frequently change roles between the 'Data Analysts', 'Data Engineers', and 'Auditors' teams. The security team is frustrated because IAM bindings are granted directly to individual user accounts, causing access drift and lengthy offboarding when people move teams. They want a scalable approach that lets access follow team membership and simplifies audits. What should they implement?

Accepted Answer

Create Google Groups in Cloud Identity for each team, grant IAM roles to the groups at the appropriate resource level, and manage access by adjusting group membership.

Answer

Grant each user the Owner role at the organization level and use IAM Conditions to restrict what resources they can touch based on job title attributes.

Answer

Create a separate service account for each team and have employees impersonate the relevant service account when they need access.

Answer

Assign IAM roles directly to individual users but automate the binding changes with a nightly script that reconciles a spreadsheet of team assignments.

Question 31

Your organization already manages employee identities in an on-premises Active Directory and a third-party identity provider (Okta) that supports SAML 2.0. Leadership wants employees to sign in to Google Cloud using their existing Okta credentials, and wants Okta to remain the authoritative source for authentication. You must ensure that when users authenticate, they are redirected to Okta and that Google Cloud does not store or validate their passwords. What should you configure?

Accepted Answer

Configure Cloud Identity with third-party SSO by setting Okta as the SAML identity provider (IdP) and Cloud Identity as the service provider (SP).

Answer

Enable Google Cloud Directory Sync (GCDS) and let it synchronize password hashes from Active Directory to Cloud Identity.

Answer

Create all users manually in the Cloud Identity Admin console and enforce 2-Step Verification for each account.

Answer

Configure workload identity federation so Okta issues tokens that map to Google Cloud service accounts for each employee.

Question 32

Your organization recently adopted Google Cloud with Cloud Identity. The security team is concerned that the highly privileged super administrator accounts could be phished or compromised, leading to a full takeover of the Google Cloud organization. Which combination of practices best protects these super admin accounts while keeping them available for emergency use?

Accepted Answer

Enforce hardware security key 2-Step Verification on the super admin accounts, use them only for break-glass tasks, and delegate day-to-day administration through IAM roles on separate accounts

Answer

Assign the Organization Administrator IAM role to all daily administrator accounts and disable the built-in super admin accounts entirely

Answer

Enable SMS-based 2-Step Verification on the super admin accounts and share the credentials in a team password manager for availability

Answer

Grant each engineer their own super admin account so that access is auditable per individual and no shared credentials exist

Question 33

A financial services company needs to digitally sign software release artifacts so that downstream consumers can verify authenticity and integrity without ever having access to the private signing key. The security team wants Google Cloud to generate and store the private key material such that it can never be exported, while allowing external partners to obtain the public key for verification. Which Cloud KMS approach should they implement?

Accepted Answer

Create an asymmetric signing key (key purpose ASYMMETRIC_SIGN) in Cloud KMS, sign artifacts with the private key version, and distribute the retrievable public key to partners for verification.

Answer

Create a symmetric encryption key in Cloud KMS and share it with partners over a secured channel for verifying signatures.

Answer

Generate the key pair locally with OpenSSL, import the private key into Secret Manager, and email the public key to partners.

Answer

Create an asymmetric decryption key (key purpose ASYMMETRIC_DECRYPT) and have partners use it to decrypt and validate the artifact hash.

Question 34

A development team needs to encrypt large volumes of application data (multi-gigabyte objects) at the application layer before storing them in Cloud Storage. Cloud KMS has a payload size limit of 64 KiB per encrypt/decrypt request, so calling the KMS API directly on each large object is not feasible. The security team requires that the encryption approach still centralize key control in Cloud KMS and support key rotation. What is the recommended technique?

Accepted Answer

Use envelope encryption: generate a local data encryption key (DEK), encrypt the data with the DEK, then call Cloud KMS to encrypt (wrap) the DEK with a key encryption key (KEK) and store the wrapped DEK alongside the data

Answer

Split each large object into 64 KiB chunks and call the Cloud KMS encrypt API sequentially on each chunk, then reassemble the ciphertext

Answer

Enable customer-managed encryption keys (CMEK) on the Cloud Storage bucket and let the application upload data unencrypted, relying on Google to encrypt at rest

Answer

Export the Cloud KMS key material to the application so it can encrypt objects locally without the payload size limit

Question 35

A security engineer at a fintech company accidentally scheduled the destruction of a Cloud KMS symmetric key version that still encrypts several active BigQuery datasets and Cloud Storage objects. The destruction was initiated 6 hours ago. The engineer needs to prevent permanent data loss while following the least-disruptive supported recovery path. What should the engineer do?

Accepted Answer

Immediately restore the key version using the Cloud KMS restore operation, since scheduled destruction has a default 24-hour waiting period before the version is permanently destroyed.

Answer

Create a new key version, re-encrypt all affected datasets and objects with the new version, and let the scheduled version be destroyed.

Answer

Open a support case with Google Cloud to recover the key material from Google's escrow copy after it has been destroyed.

Answer

Import a copy of the destroyed key material back into the key ring using the Cloud KMS import job before the destruction completes.

Question 36

A financial services company uses Cloud KMS to protect customer records. The security team requires that the engineers who manage the lifecycle of encryption keys (creating, rotating, and disabling keys) must NOT be able to use those keys to decrypt any data, enforcing separation of duties. The application service account only needs to perform cryptographic operations. How should you configure IAM to meet this requirement?

Accepted Answer

Grant the key administrators roles/cloudkms.admin on the key ring and grant the application service account roles/cloudkms.cryptoKeyEncrypterDecrypter on the keys.

Answer

Grant both the key administrators and the application service account roles/cloudkms.admin, and rely on audit logs to detect misuse of decryption.

Answer

Grant the key administrators roles/owner on the project and grant the application service account roles/cloudkms.cryptoKeyEncrypterDecrypter on the keys.

Answer

Grant the key administrators roles/cloudkms.cryptoKeyEncrypterDecrypter and grant the application service account roles/cloudkms.admin to allow it to manage its own keys.

Question 37

A security team must centralize audit logs from all projects in an organization into a single BigQuery dataset for long-term analysis. They want the collection to automatically include any projects created in the future, and they must exclude high-volume Data Access logs from Cloud Storage to control BigQuery ingestion costs. Which approach meets all requirements with the least ongoing maintenance?

Accepted Answer

Create an aggregated log sink at the organization level with includeChildren enabled, route it to the BigQuery dataset, and add an exclusion filter for the Cloud Storage Data Access logs.

Answer

Create a separate log sink in every existing project pointing to the BigQuery dataset and configure Cloud Scheduler to create sinks in new projects automatically.

Answer

Enable a log sink in each project that routes all logs to a Pub/Sub topic, then use a Cloud Function to filter and load logs into BigQuery.

Answer

Create an aggregated sink at the organization level routing to Cloud Storage, then schedule a BigQuery load job that skips Data Access log files.

Question 38

A security analyst must be alerted whenever any user downloads (creates) a service account key across the organization, because service account key creation is prohibited by policy except for one legacy break-glass workflow. The analyst wants near-real-time notification with minimal custom code, using data already present in Admin Activity audit logs. What is the most appropriate approach?

Accepted Answer

Create a log-based metric that matches the `google.iam.admin.v1.CreateServiceAccountKey` method name in the audit logs, then configure a Cloud Monitoring alerting policy on that metric to notify the analyst.

Answer

Enable Data Access audit logs for the IAM API and build a BigQuery scheduled query that scans for key creation events each hour.

Answer

Apply an organization policy constraint that disables service account key creation, which will automatically email the analyst when a key is created.

Answer

Export all Admin Activity logs to Cloud Storage and configure Object Lifecycle notifications to trigger when new key-related objects appear.

Question 39

A security analyst at a financial services company must detect any interactive access to Compute Engine VM serial consoles, because attackers sometimes use them to bypass network-based controls and SSH logging. The organization already exports all audit logs to a central log bucket, but the analyst wants a near-real-time alert whenever serial console access is enabled or used on any VM in the organization. What is the most appropriate way to implement this detection?

Accepted Answer

Create an organization-level log-based alerting policy that matches Admin Activity audit log entries for the SetMetadata/serial-port-enable and connectToSerialPort operations, and notify the security team.

Answer

Enable Data Access audit logs for Compute Engine and rely on the default System Event logs to record serial console connections.

Answer

Configure VPC Flow Logs on all subnets and alert when traffic is seen on the serial console TCP port.

Answer

Enable OS Login for all projects, which automatically blocks and logs any serial console access attempt.

Question 40

Your security operations team wants to detect brute-force SSH login attempts against Compute Engine VMs across the organization. They need a repeatable, low-maintenance detection that produces findings in a central console alongside other threat findings, without deploying custom log parsing infrastructure. Which approach should you recommend?

Accepted Answer

Enable Event Threat Detection in Security Command Center Premium, which analyzes Cloud Logging data and surfaces brute-force SSH findings in the SCC dashboard.

Answer

Create a log-based metric on syslog auth failures in each project and configure a Cloud Monitoring alerting policy per VM.

Answer

Export all VM serial console logs to BigQuery and run scheduled queries to count failed login patterns.

Answer

Deploy the Ops Agent on every VM and write a custom Cloud Function to scan streamed auth logs for repeated failures.

Question 41

A financial services company must retain all admin activity audit logs for 7 years to satisfy a regulatory requirement. Auditors demand assurance that no one — including project owners or the security team — can delete or shorten the retention of these logs during the retention period. The logs are currently stored in the default _Required log bucket. What should the security engineer do?

Accepted Answer

Create a custom Cloud Logging log bucket with a 7-year retention period, enable a retention lock on the bucket, and route audit logs to it via a log sink.

Answer

Increase the retention period of the _Required log bucket to 7 years and grant the Logs Configuration Writer role only to the security team.

Answer

Export the audit logs to a Cloud Storage bucket with a lifecycle rule that deletes objects after 7 years, and apply uniform bucket-level access.

Answer

Create a BigQuery dataset with a table expiration of 7 years and use an aggregated sink to stream all audit logs into it for long-term retention.

Question 42

Your security operations team runs an on-premises Splunk SIEM and must ingest all Cloud Audit Logs from every project in your organization in near real time for correlation and alerting. The pipeline must be centrally managed, minimize per-project configuration, and stream logs continuously rather than in batch. Which approach should you implement?

Accepted Answer

Create an organization-level aggregated log sink that routes logs to a Pub/Sub topic, and configure the Splunk Add-on for Google Cloud (Dataflow) to pull from that subscription.

Answer

Create a log sink in each project that exports logs to a BigQuery dataset, then schedule a query that Splunk polls hourly via the BigQuery API.

Answer

Configure an organization-level aggregated sink to a Cloud Storage bucket and have Splunk's file monitor input read the exported JSON objects.

Answer

Enable Security Command Center continuous export to Pub/Sub and forward the findings to Splunk using the SCC connector.

Question 43

Your security team stores audit logs in a centralized Cloud Logging log bucket in a dedicated logging project. An external compliance auditor needs read access to only the Data Access audit logs originating from one specific production project, but the log bucket also contains logs from dozens of other projects. You must grant the auditor visibility to just the relevant logs without duplicating or exporting the data elsewhere. What is the most appropriate approach?

Accepted Answer

Create a log view on the log bucket that filters entries to the specific production project's Data Access logs, then grant the auditor the Logs View Accessor role scoped to that log view.

Answer

Grant the auditor the Logs Viewer (roles/logging.viewer) role at the logging project level so they can query the log bucket.

Answer

Create a new aggregated sink that exports only the production project's Data Access logs to a separate BigQuery dataset and grant the auditor BigQuery Data Viewer.

Answer

Grant the auditor the Private Logs Viewer (roles/logging.privateLogViewer) role on the logging project to allow read access to the Data Access logs.

Question 44

A security operations team at a financial services company needs to investigate a suspected data exfiltration incident. Several private VMs in a subnet use Cloud NAT for outbound internet access to reach a partner API. The team needs to determine exactly which destination IP addresses and ports the VMs connected to during a specific time window, and whether any connections were dropped due to NAT port exhaustion. Currently no NAT observability is configured. What should the team enable to obtain this evidence with the least operational overhead?

Accepted Answer

Enable Cloud NAT logging on the NAT gateway with the filter set to log both translations and errors, then query the logs in Cloud Logging.

Answer

Enable VPC Flow Logs on the subnet and correlate the internal source IPs with the NAT external IP manually to identify destinations.

Answer

Deploy a packet mirroring policy on the subnet and forward captured traffic to a collector instance for full packet analysis.

Answer

Enable Firewall Rules Logging on the egress allow rule and inspect the connection tuples for the affected VMs.

Question 45

A financial services company runs a fleet of 200 backend VMs (no external IPs) in a single subnet. These VMs make a very high volume of outbound API calls to a small number of external partner endpoints. Operations reports intermittent connection failures, and Cloud NAT logs show numerous 'OUT_OF_RESOURCES' drop entries for allocation, even though CPU and network throughput are well within limits. The team needs to resolve the failures without adding public IPs to the VMs. What is the most effective action?

Accepted Answer

Increase the minimum ports per VM instance allocation on the Cloud NAT gateway (and consider enabling dynamic port allocation) so more source ports are available for connections to the same destination.

Answer

Assign ephemeral external IP addresses to the backend VMs so they can bypass the NAT gateway for outbound traffic.

Answer

Lower the TCP established idle timeout to 30 seconds so ports are recycled, and leave the default 64 ports per VM unchanged.

Answer

Replace Cloud NAT with a Secure Web Proxy to handle all outbound partner API traffic and rely on its connection pooling.

Question 46

A financial services company runs a fleet of backend processing VMs in a private subnet within a Shared VPC. Organization policy prohibits assigning external IP addresses to these VMs. However, the VMs must periodically download OS security patches and pull dependencies from public package repositories on the internet. Inbound connections from the internet to these VMs must remain impossible. What should the security engineer configure to meet these requirements?

Accepted Answer

Deploy Cloud NAT for the subnet's region and configure it to provide outbound-only internet access for the private VMs

Answer

Assign ephemeral external IP addresses to the VMs and create an egress firewall rule allowing traffic to package repositories

Answer

Create a Private Service Connect endpoint that forwards VM traffic to public package repositories

Answer

Configure Cloud VPN to route VM internet-bound traffic through an on-premises proxy with a public IP

Question 47

A financial services company runs a fleet of backend processing VMs in a private subnet with no external IP addresses. These VMs must call a third-party payment partner's REST API over the public internet. The partner requires that all inbound traffic originate from a small, fixed set of source IP addresses that the company must register on the partner's allowlist. The security team also needs to guarantee the egress source addresses do not change over time. How should you configure egress connectivity?

Accepted Answer

Deploy Cloud NAT configured with manually reserved static external IP addresses, and register those reserved IPs on the partner's allowlist.

Answer

Assign ephemeral external IP addresses to each VM and provide the partner with the current set of assigned IPs.

Answer

Deploy Cloud NAT with automatic NAT IP address allocation so Google Cloud scales the addresses as traffic grows, then register the allocated pool with the partner.

Answer

Route egress through a Secure Web Proxy instance and register the proxy's dynamically assigned IP with the partner.

Question 48

A data engineering team creates a BigQuery dataset in the US multi-region and configures it to use a customer-managed encryption key (CMEK). They created their Cloud KMS key ring in the us-central1 region. When they try to associate the key with the dataset, the operation fails. What is the most likely cause and the correct remediation?

Accepted Answer

The Cloud KMS key and the BigQuery dataset must be in compatible locations; recreate the key in the US multi-region (or a supported location) so the key location matches the dataset location.

Answer

BigQuery does not support CMEK; the team must use CSEK by supplying the key material with each query and load job.

Answer

The BigQuery service account lacks the roles/owner role on the project; grant Owner to the BigQuery service agent to allow key association.

Answer

CMEK keys must always be stored in Cloud HSM; migrate the key to a Cloud HSM protection level and retry the association.

Question 49

A retail company stores customer PII in a Cloud Storage bucket within a project named 'data-prod'. Their security policy requires that all objects be encrypted with a Cloud KMS key managed in a separate, dedicated project named 'kms-central' to enforce separation of duties. When engineers upload objects to the bucket, encryption fails with a permission error. What must be configured so that objects are automatically encrypted using the CMEK from the other project?

Accepted Answer

Grant the Cloud Storage service agent of the 'data-prod' project the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the KMS key in 'kms-central', and set the key as the bucket's default encryption key.

Answer

Grant the user accounts uploading objects the roles/cloudkms.admin role in 'kms-central' and re-run the uploads.

Answer

Enable customer-supplied encryption keys (CSEK) on the bucket and pass the KMS key material with each upload request.

Answer

Copy the KMS key into the 'data-prod' project and configure it as the bucket default encryption key, since CMEK keys cannot be used across projects.

Question 50

A financial services company must comply with a regulation that requires the encryption keys protecting their BigQuery datasets to be generated and stored outside of Google Cloud, entirely under the control of the organization's on-premises third-party key management system. The security team must ensure Google never has access to the raw key material, while still enabling BigQuery to use Google's managed infrastructure. Which encryption approach should they implement?

Accepted Answer

Configure Cloud External Key Manager (Cloud EKM) so BigQuery uses CMEK backed by a key hosted in the external key management partner system

Answer

Use Cloud HSM to generate FIPS 140-2 Level 3 keys within Google Cloud and grant BigQuery access to them

Answer

Enable customer-supplied encryption keys (CSEK) and supply the raw key material to BigQuery with each query

Answer

Import the external key into Cloud KMS as a key import job and rotate it manually from on-premises

Question 51

A financial services company stores highly regulated customer data in BigQuery and Cloud Storage, encrypted with Cloud KMS CMEK keys. Auditors require that any time Google or an internal automated process attempts to use these keys to decrypt data, the company can review the stated reason for access and automatically deny requests that lack an approved business justification. Which Cloud KMS capability should the security engineer configure to meet this requirement?

Accepted Answer

Enable Key Access Justifications and configure a justification policy that allows only approved reason codes, denying key use for unapproved justifications

Answer

Enable Cloud KMS key rotation on a 30-day schedule so that any unauthorized access is limited to a single key version

Answer

Configure Cloud Audit Logs for Cloud KMS to capture data access events and set up log-based alerts for decrypt operations

Answer

Migrate the CMEK keys to Cloud HSM to ensure hardware-backed key protection and FIPS 140-2 Level 3 compliance

Question 52

A large enterprise is standardizing CMEK across hundreds of new BigQuery datasets, Cloud Storage buckets, and Compute Engine disks created by many teams. Security wants each protected resource to use its own dedicated, purpose-built Cloud KMS key that is automatically generated in the correct region and follows a consistent naming and IAM convention, without developers manually creating key rings and keys for every resource. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Enable Cloud KMS Autokey so that CMEK keys are provisioned on demand per resource, in the matching location, following a managed folder-scoped configuration.

Answer

Create a single organization-wide KMS key in the multi-region and require every team to reference it as the CMEK for all resource types.

Answer

Write a Terraform module that each team must copy and run to create key rings and keys before provisioning any protected resource.

Answer

Use Cloud External Key Manager (EKM) to import externally managed keys and assign them to each new resource as it is created.

Question 53

A financial services company must comply with a regulation requiring that the cryptographic keys protecting customer data in BigQuery and Cloud Storage be generated on the company's on-premises FIPS 140-2 Level 3 hardware security module and never exist in software form inside Google Cloud. The company still wants to use Cloud KMS to manage the key lifecycle and reference the keys as CMEK on Google Cloud resources. Which approach meets these requirements?

Accepted Answer

Configure Cloud External Key Manager (Cloud EKM) so Cloud KMS references key material that remains in an external key management system, then use it as CMEK.

Answer

Create Cloud HSM keys in Cloud KMS and enable automatic rotation so keys are generated inside Google's HSM.

Answer

Generate the key material on the on-premises HSM and import it into Cloud KMS as an imported key, then reference it as CMEK.

Answer

Use customer-supplied encryption keys (CSEK) by passing the raw key from the on-premises HSM with each Cloud Storage request.

Question 54

A financial services company encrypts all Compute Engine persistent disks with a CMEK stored in Cloud KMS. During a suspected credential compromise, the security team must immediately render all data on those disks inaccessible while preserving the ability to restore access after the incident is investigated and cleared. Which action best meets this requirement?

Accepted Answer

Disable the CMEK key version in Cloud KMS, then re-enable it once the incident is cleared.

Answer

Schedule the CMEK key version for destruction, which starts a 30-day recovery window.

Answer

Remove all IAM bindings that grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the key.

Answer

Rotate the CMEK key to a new primary version so the old data can no longer be decrypted.

Question 55

A financial services company must demonstrate continuous compliance with the PCI DSS framework for a set of Google Cloud projects. The compliance team needs an automated way to assess resource configurations against PCI DSS control requirements and to generate downloadable evidence and control-mapping reports for external auditors, without building custom scripts. Which Google Cloud capability best meets this requirement?

Accepted Answer

Use Audit Manager to run compliance assessments that map resource configurations to PCI DSS controls and produce exportable evidence reports

Answer

Enable Data Access audit logs across all projects and manually correlate log entries to each PCI DSS control

Answer

Deploy resources into an Assured Workloads folder configured for FedRAMP High to inherit PCI DSS controls

Answer

Configure Access Transparency logs to record Google personnel actions as proof of PCI DSS compliance

Question 56

A financial services company must provide external auditors with Google's third-party attestation documents (SOC 2 Type II, ISO 27001, PCI DSS) to demonstrate that the underlying cloud infrastructure meets shared-responsibility control requirements. The compliance team needs a self-service way to obtain these certifications and audit reports directly from Google Cloud without opening a support case. Which approach should they use?

Accepted Answer

Download the certifications and audit reports from Compliance Reports Manager in the Google Cloud console.

Answer

Enable Access Transparency logs and export them to the auditors as evidence of Google's control operation.

Answer

Create an Assured Workloads environment and reference its control package as the attestation document.

Answer

Query Cloud Audit Logs Admin Activity entries to generate a SOC 2 report for the auditors.

Question 57

A financial services company has a strict compliance requirement that Google must never have the ability to independently decrypt data stored on Compute Engine persistent disks. The security team wants to supply and manage the raw encryption key material themselves, storing keys entirely outside of Google Cloud in their on-premises HSM. They must provide the key each time a disk is created, attached, or a VM is started. Which encryption approach meets these requirements?

Accepted Answer

Use Customer-Supplied Encryption Keys (CSEK), passing the raw key material with each Compute Engine API request

Answer

Use Customer-Managed Encryption Keys (CMEK) with a key stored in Cloud KMS and disable Google-managed rotation

Answer

Use Cloud HSM to generate the key and grant the Compute Engine service agent the Cloud KMS CryptoKey Encrypter/Decrypter role

Answer

Use Cloud External Key Manager (EKM) to reference the on-premises key over an internet connection

Question 58

A data governance team needs a group of auditors to list all Cloud Storage buckets in a project and view each bucket's IAM policy and configuration metadata, but they must NOT be able to read the objects stored inside any bucket. The security engineer wants to grant the narrowest possible access. Which approach best satisfies least privilege?

Accepted Answer

Create a custom role containing only storage.buckets.list, storage.buckets.get, and storage.buckets.getIamPolicy permissions, and grant it to the auditors group at the project level.

Answer

Grant the auditors group the predefined roles/storage.objectViewer role at the project level.

Answer

Grant the auditors group the predefined roles/storage.admin role at the project level.

Answer

Grant the auditors group roles/viewer at the project level so they can inspect all resources read-only.

Question 59

A financial services company must retain evidence that all read and write operations on customer data across every project in their Google Cloud organization are logged for a regulatory audit. The compliance team discovers that while Admin Activity logs are captured everywhere, Data Access logs are inconsistently enabled — some project owners enabled them, others did not. Auditors require a consistent, organization-wide guarantee going forward without relying on individual project owners. What is the most effective way to meet this requirement?

Accepted Answer

Set an organization-level IAM audit configuration (default audit config) that enables DATA_READ and DATA_WRITE log types, so all current and future projects inherit the setting.

Answer

Create an aggregated log sink at the organization level to export all logs to BigQuery, which will automatically enable Data Access logs.

Answer

Apply an organization policy constraint that forces Data Access logging on for all services in every project.

Answer

Ask each project owner to enable Data Access logs manually and monitor compliance with a scheduled Cloud Function.

Question 60

A financial services company ingests unstructured customer support transcripts into a Cloud Storage bucket. The security team must automatically detect US Social Security Numbers and passport numbers, but their initial scans return too many false positives on internal account reference numbers that happen to match the SSN pattern. They want to reduce false positives without stopping detection of genuine SSNs. Which Sensitive Data Protection configuration change should they make?

Accepted Answer

Add the internal account reference number format to a custom exclusion rule (exclusion detection rule) in the inspection template so matching values are removed from findings

Answer

Lower the minimum likelihood threshold from LIKELY to POSSIBLE so more context is captured for each finding

Answer

Replace the built-in US_SOCIAL_SECURITY_NUMBER infoType with a regular-expression custom infoType that matches any nine-digit number

Answer

Disable the SSN infoType and rely only on manual review of transcripts flagged by the passport infoType

Question 61

A media company allows external partners to upload files to a Cloud Storage bucket. Compliance requires that any object containing sensitive data (credit card numbers, national IDs) never remain in the publicly writable ingestion bucket. Security wants an automated pipeline that inspects each newly uploaded object and moves clean files to a processing bucket while relocating files with sensitive findings to a restricted quarantine bucket for review. Which architecture best meets these requirements using Google-managed services?

Accepted Answer

Configure a Cloud Storage notification to Pub/Sub on object creation that triggers a Cloud Function which calls the Sensitive Data Protection (DLP) content.inspect API, then moves the object to the processing or quarantine bucket based on findings.

Answer

Enable Cloud Storage Object Versioning on the ingestion bucket and use a lifecycle rule to delete objects older than one day.

Answer

Schedule a daily DLP inspection job against the ingestion bucket and review the findings in the Security Command Center dashboard.

Answer

Apply a CMEK key to the ingestion bucket and grant partners only the objectCreator role so uploaded data is encrypted at rest.

Question 62

A healthcare analytics team wants to share a de-identified copy of a patient dataset with external researchers. An 'age' column contains exact ages that, combined with ZIP code and gender, could re-identify individuals. Analysts still need to perform statistical analysis across broad age groups (0-17, 18-64, 65+). The team must transform the data using Sensitive Data Protection (DLP) while preserving analytic utility. Which de-identification transformation should they apply to the age column?

Accepted Answer

Apply a bucketing transformation to generalize ages into the defined ranges

Answer

Apply deterministic cryptographic tokenization (crypto deterministic) to the age values

Answer

Apply date-shift transformation with a fixed shift value to the age column

Answer

Apply a redaction transformation that removes the age column entirely

Question 63

A healthcare analytics company must share a BigQuery dataset containing patient identifiers with an external research partner. The security team requires that direct identifiers (like medical record numbers) be replaced with tokens so records can still be joined across tables using the same identifier, and the original values must be recoverable later by an authorized internal team for audit purposes. The tokenization must be resistant to unauthorized reversal even if the transformed dataset is exposed. Which Sensitive Data Protection de-identification technique should they use?

Accepted Answer

Deterministic encryption using a KMS-wrapped crypto key (cryptoDeterministicConfig)

Answer

Cryptographic hashing (cryptoHashConfig) with a wrapped key

Answer

Character masking (characterMaskConfig) replacing digits with asterisks

Answer

Date shifting (dateShiftConfig) with a fixed random offset

Question 64

A data engineering team at a healthcare analytics company must de-identify a customer email address column before loading data into BigQuery for analysts. Requirements: (1) the same email must always produce the same token so analysts can perform GROUP BY joins across tables, (2) the wrapped cryptographic key used for tokenization must never be embedded in the Sensitive Data Protection (DLP) template or stored in plaintext, and (3) the security team must be able to rotate the key material centrally. Which configuration satisfies all requirements?

Accepted Answer

Use a cryptoDeterministicConfig transformation with a KMS-wrapped crypto key (kmsWrapped), storing only the ciphertext key reference and the Cloud KMS resource name in the de-identify template.

Answer

Use a cryptoReplaceFfxFpeConfig transformation with an unwrapped transient crypto key generated per job so no key persists anywhere.

Answer

Use a cryptoDeterministicConfig transformation with an unwrapped raw key value placed directly in the de-identify template for reproducibility.

Answer

Use a replaceWithInfoTypeConfig transformation and rely on Cloud KMS to encrypt the resulting BigQuery table at rest.

Exam domain	Exam weight	Practice
Configuring access	25%	Practice this topic
Securing communications and establishing boundary protection	22%	Practice this topic
Ensuring data protection	23%	Practice this topic
Managing operations	19%	Practice this topic
Supporting compliance requirements	11%	Practice this topic

Professional Cloud Security Engineer (PCSE) practice exam & study guide

Start studying PCSE

All PCSE study resources

PCSE exam domains

Sample PCSE questions

Key PCSE terms

PCSE frequently asked questions

Configuring access (25%)

Securing communications and establishing boundary protection (22%)

Ensuring data protection (23%)

Managing operations (19%)

Supporting compliance requirements (11%)