Supporting compliance requirements — PCSE Practice Quiz

Question 1

A financial services company operating under strict regulatory requirements must ensure that no Google support or engineering personnel can access their customer data unless the company's own security team has explicitly granted permission for each access request. They already have Access Transparency logs enabled but want to move from passive visibility to active pre-authorization. Which capability should they configure to meet this requirement?

Accepted Answer

Enable Access Approval so that a designated approver in the organization must grant explicit consent before Google personnel can access covered resources

Answer

Configure Key Access Justifications with a policy that automatically denies all unjustified key access requests

Answer

Enable Data Access audit logs for all services so that every read of customer data is recorded for review

Answer

Deploy an Assured Workloads folder to restrict Google support personnel to in-region staff only

Question 2

A financial services company must document to their auditors that all Google personnel access to their production data is logged. Their compliance team wants to enable Access Transparency logs across the organization. During the enablement review, the security engineer discovers that Access Transparency is not available to activate for the organization. What is the most likely prerequisite the company has not met?

Accepted Answer

The organization does not have a qualifying support level such as Premium, Enhanced, or Platinum Support (or equivalent role-based support).

Answer

Data Access audit logs have not been enabled for all services in the organization.

Answer

The organization has not deployed an Assured Workloads folder for regulated data.

Answer

Access Approval has not been configured to require approval before support access.

Question 3

A financial services company is preparing documentation for an external auditor who is assessing the organization's ability to demonstrate oversight of any Google personnel access to customer content. The security team has already enabled Cloud Audit Logs (Admin Activity and Data Access). The auditor specifically asks for evidence showing when Google support or engineering staff accessed customer content, along with the justification for that access. Which action provides the required evidence?

Accepted Answer

Enable Access Transparency logs, which record actions taken by Google personnel on customer content, including the reason/justification for the access.

Answer

Enable Data Access audit logs for all services, since they capture every read and write of customer content including those performed by Google staff.

Answer

Configure Access Approval so that all Google personnel access is blocked, then export the denied-request records as audit evidence.

Answer

Create a log-based metric on Admin Activity logs to alert whenever a Google service account modifies IAM policy on customer resources.

Question 4

A financial services company must demonstrate to auditors that they have visibility into any actions Google Cloud support or engineering personnel take on their data, and that such access requires explicit organizational sign-off before it occurs. The compliance team has already enabled Access Transparency logs across the organization. During an audit rehearsal, they realize they cannot show evidence that Google personnel access was ever gated on their own approval. Which additional capability should they enable to meet the requirement that Google personnel access be explicitly authorized by the organization before it happens?

Accepted Answer

Access Approval, which requires the organization to grant explicit approval before Google personnel can access covered resources

Answer

Data Access audit logs, which record read and write operations performed on user data

Answer

Access Context Manager access levels that restrict console access to corporate IP ranges

Answer

Cloud Audit Logs Admin Activity logs, which capture configuration changes made by Google support

Question 5

A healthcare organization runs regulated workloads in an Assured Workloads folder configured for a US-based compliance regime. During a routine audit, the compliance team must demonstrate to regulators that Google support and engineering personnel cannot access customer content without a documented business justification, and that any such access is logged with a reason code. Which capability should the team point to as evidence of this control?

Accepted Answer

Access Transparency logs combined with Access Approval, which record and gate Google personnel access with justification reason codes

Answer

Key Access Justifications (KAJ), which requires an approved justification reason before Google can use a CMEK key to decrypt data

Answer

Cloud Audit Logs Admin Activity entries, which capture all administrative API calls made by customer identities

Answer

VPC Service Controls perimeters, which prevent data exfiltration by blocking API access from outside the perimeter

Question 6

A healthcare company runs regulated workloads in an Assured Workloads folder configured for a specific compliance regime. The compliance team needs an automated way to be alerted when a resource is created or modified in a way that violates the Assured Workloads controls (for example, a resource deployed outside the approved region), so they can document and remediate the drift. Which capability should they use?

Accepted Answer

Enable Assured Workloads monitoring, which surfaces compliance violations (such as resource location or configuration drift) in the console and can generate findings for review and remediation

Answer

Rely on Access Transparency logs to detect when resources drift from the approved compliance configuration

Answer

Configure a Cloud DLP inspection job to scan resources and flag those that violate the compliance regime

Answer

Use Cloud Billing budget alerts to detect resources deployed outside approved regions

Question 7

A financial services company already runs several production projects in a Google Cloud organization. New regulations now require that a subset of these workloads meet a specific compliance regime with strict data residency and personnel access controls. The security team wants to bring these workloads under Assured Workloads with the least effort while ensuring compliance controls are actually enforced. What is the correct approach?

Accepted Answer

Create a new Assured Workloads folder for the required compliance regime and provision new projects within it, then migrate the regulated workloads into those projects.

Answer

Apply an organization policy constraint that restricts resource locations to the compliant regions on the existing projects, which retroactively converts them into Assured Workloads environments.

Answer

Enable the Assured Workloads API on each existing project so its current resources are automatically brought into scope for the compliance regime.

Answer

Move the existing projects unchanged into a standard folder and rely on Access Transparency logs to demonstrate compliance with the residency and personnel requirements.

Question 8

A healthcare company is deploying a new analytics platform on Google Cloud that must comply with a regional data sovereignty regulation requiring that all cryptographic key material be generated, stored, and controlled outside of Google's infrastructure and remain in the customer's jurisdiction. The security team has created an Assured Workloads folder configured for the appropriate compliance regime. During design review, an architect asks how encryption keys should be managed to satisfy the requirement that Google must never have access to unwrapped key material. Which approach should the team adopt?

Accepted Answer

Use CMEK backed by Cloud External Key Manager (EKM), storing keys in a supported third-party key management partner outside Google Cloud

Answer

Use CMEK backed by Cloud HSM in the same region, relying on FIPS 140-2 Level 3 hardware to isolate key material

Answer

Rely on Google-managed default encryption, since Assured Workloads already enforces data residency for the folder

Answer

Import externally generated keys into Cloud KMS using the key import feature so Google stores the wrapped versions

Question 9

A European financial services company must onboard to Google Cloud while meeting EU digital sovereignty requirements. Their legal team mandates that data storage and processing remain within EU boundaries, that Google support personnel access is restricted to EU-based staff, and that customer approval is required before any Google administrator can access data during support operations. Which approach best satisfies these compliance requirements with the least custom engineering effort?

Accepted Answer

Create an Assured Workloads folder using the 'EU Regions and Support' compliance regime, which enforces EU data residency and personnel controls, and enable Key Access Justifications with Access Approval for administrator access control.

Answer

Apply an organization policy list constraint restricting resource locations to EU regions and rely on default Access Transparency logs to review Google access after the fact.

Answer

Deploy resources into europe-west regions and configure VPC Service Controls perimeters to block all Google support access to the data.

Answer

Use CMEK with an external key manager (EKM) hosted in the EU and manually revoke keys whenever Google support activity is detected in audit logs.

Question 10

A U.S. federal contractor must run a new workload on Google Cloud under FedRAMP Moderate authorization. During planning, an engineer proposes using an Assured Workloads folder configured for the FedRAMP Moderate control package. A developer asks to deploy a Google Cloud service that is NOT on the list of products supported by that Assured Workloads compliance regime. What is the correct guidance for maintaining compliance within the Assured Workloads folder?

Accepted Answer

Only services in the Assured Workloads supported-products list for FedRAMP Moderate may be used in the folder; using an unsupported service risks violating the compliance controls and should be avoided or flagged by the org policy restrictions Assured Workloads applies.

Answer

Assured Workloads will automatically bring the unsupported service into scope, so it can be used freely once deployed inside the folder.

Answer

Enable Access Transparency on the project, which retroactively certifies any service for FedRAMP Moderate.

Answer

Grant the developer a custom IAM role scoped to the unsupported service, which satisfies FedRAMP Moderate personnel controls.

Question 11

A US federal contractor must run a new workload in Google Cloud that handles Controlled Unclassified Information (CUI). Compliance requires that the data remain within US regions, that only US-based Google support personnel who have passed government background checks can access the environment, and that the control package aligns with the DoD Impact Level 4 (IL4) framework. The security team wants Google to enforce these constraints programmatically at folder creation rather than relying on manually applied org policies. What should they do?

Accepted Answer

Create an Assured Workloads folder using the DoD IL4 compliance regime, then deploy the workload resources into projects within that folder.

Answer

Apply a resource location org policy constraint restricting all resources to US regions and enable Access Transparency logs on the projects.

Answer

Enable VPC Service Controls with an access level requiring US corporate IP ranges, and configure CMEK with keys stored in US regions.

Answer

Purchase a Google Cloud premium support plan that guarantees US-based support engineers, then apply data residency org policies manually.

Question 12

A financial services company must demonstrate to auditors that all administrative configuration changes to Google Cloud resources over the past 18 months can be produced on demand. The compliance team discovers that Admin Activity audit logs are being relied upon for this evidence, but is concerned they will not satisfy the 18-month retention requirement. Which action correctly addresses this concern while minimizing operational overhead?

Accepted Answer

Admin Activity logs are retained by default for 400 days, so create a log sink that routes them to a log bucket or Cloud Storage with an 18-month retention policy

Answer

Enable Data Access audit logs for all services, since Admin Activity logs are only retained for 30 days

Answer

Manually export the _Required log bucket contents each week to a spreadsheet to preserve them beyond their default 30-day retention

Answer

Disable the _Required bucket and create a new default bucket with a custom retention period to capture Admin Activity logs

Question 13

A financial services company must demonstrate to auditors that all reads and writes to a specific set of BigQuery datasets holding regulated customer data are logged, without incurring the cost and volume of enabling Data Access logs across every service in the organization. Their compliance mandate applies only to those datasets. What is the recommended approach to configure Data Access audit logs to satisfy this requirement efficiently?

Accepted Answer

Configure the IAM audit log settings to enable DATA_READ and DATA_WRITE for the BigQuery service scoped to the specific project containing the regulated datasets, and optionally use exempted members to reduce noise

Answer

Enable Data Access logs for the BigQuery service at the organization level and use log exclusion filters to drop everything except the regulated datasets

Answer

Rely on Admin Activity audit logs, which automatically capture all data read and write operations for regulated BigQuery datasets

Answer

Enable Access Transparency logs for the project, since they record all data access to customer data in the regulated datasets

Question 14

A compliance auditor asks your team to demonstrate which Cloud Audit Logs categories are always captured for a GCP organization without any administrator action to enable them, and which cannot be disabled. During a review, a security engineer claims that all audit log types must be explicitly enabled before they generate entries. Which statement correctly describes the default and configurability behavior of Cloud Audit Log types that you should document for the auditor?

Accepted Answer

Admin Activity and System Event logs are written by default and cannot be disabled, while Data Access logs (except BigQuery) are disabled by default and must be enabled.

Answer

All four audit log types (Admin Activity, System Event, Data Access, Policy Denied) are disabled by default and must be individually enabled in the organization's data access configuration.

Answer

Admin Activity logs are disabled by default but System Event and Data Access logs are always enabled and cannot be turned off.

Answer

Only Data Access logs are written by default; Admin Activity and System Event logs require enabling an audit configuration at the organization level.

Question 15

A financial services company must demonstrate continuous compliance with the PCI DSS framework for a set of Google Cloud projects. The compliance team needs an automated way to assess resource configurations against PCI DSS control requirements and to generate downloadable evidence and control-mapping reports for external auditors, without building custom scripts. Which Google Cloud capability best meets this requirement?

Accepted Answer

Use Audit Manager to run compliance assessments that map resource configurations to PCI DSS controls and produce exportable evidence reports

Answer

Enable Data Access audit logs across all projects and manually correlate log entries to each PCI DSS control

Answer

Deploy resources into an Assured Workloads folder configured for FedRAMP High to inherit PCI DSS controls

Answer

Configure Access Transparency logs to record Google personnel actions as proof of PCI DSS compliance

Question 16

A financial services company must provide external auditors with Google's third-party attestation documents (SOC 2 Type II, ISO 27001, PCI DSS) to demonstrate that the underlying cloud infrastructure meets shared-responsibility control requirements. The compliance team needs a self-service way to obtain these certifications and audit reports directly from Google Cloud without opening a support case. Which approach should they use?

Accepted Answer

Download the certifications and audit reports from Compliance Reports Manager in the Google Cloud console.

Answer

Enable Access Transparency logs and export them to the auditors as evidence of Google's control operation.

Answer

Create an Assured Workloads environment and reference its control package as the attestation document.

Answer

Query Cloud Audit Logs Admin Activity entries to generate a SOC 2 report for the auditors.

Question 17

A financial services company must retain evidence that all read and write operations on customer data across every project in their Google Cloud organization are logged for a regulatory audit. The compliance team discovers that while Admin Activity logs are captured everywhere, Data Access logs are inconsistently enabled — some project owners enabled them, others did not. Auditors require a consistent, organization-wide guarantee going forward without relying on individual project owners. What is the most effective way to meet this requirement?

Accepted Answer

Set an organization-level IAM audit configuration (default audit config) that enables DATA_READ and DATA_WRITE log types, so all current and future projects inherit the setting.

Answer

Create an aggregated log sink at the organization level to export all logs to BigQuery, which will automatically enable Data Access logs.

Answer

Apply an organization policy constraint that forces Data Access logging on for all services in every project.

Answer

Ask each project owner to enable Data Access logs manually and monitor compliance with a scheduled Cloud Function.

More PCSE practice