Your customer is moving their corporate applications to Google Cloud Platform. The security team wants
detailed visibility of all projects in the organization. You provision the Google Cloud Resource Manager and
set up yourself as the org admin.
What Google Cloud Identity and Access Management (Cloud IAM) roles should you give to the security
team?

• A.Org viewer, project owner
• B.Org viewer, project viewer
• C.Project owner, network admin
• D.Org admin, project browser

Comment: *

Name: *

Email: *

Verification: *

A lead software engineer tells you that his new application design uses websockets and HTTP sessions that are not distributed across the web servers. You want to help him ensure his application will run property on Google Cloud Platform. What should you do?

• A.Help the engineer to convert his websocket code to use HTTP streaming.
• B.Review the encryption requirements for websocket connections with the security team.
• C.Meet with the cloud operations team and the engineer to discuss load balancer options.
• D.Help the engineer redesign the application to use a distributed user session service that does not rely on websockets and HTTP sessions.

Comment: *

Name: *

Email: *

Verification: *

Your company is designing its application landscape on Compute Engine. Whenever a zonal outage occurs, the application should be restored in another zone as quickly as possible with the latest application data. You need to design the solution to meet this requirement. What should you do?

• A.Configure the Compute Engine instances with an instance template for the application, and use a regional persistent disk for the application data. Whenever a zonal outage occurs, use the instance template to spin up the application in another zone in the same region. Use the regional persistent disk for the application data.
• B.Create a snapshot schedule for the disk containing the application data. Whenever a zonal outage occurs, use the latest snapshot to restore the disk in another zone within the same region.
• C.Create a snapshot schedule for the disk containing the application data. Whenever a zonal outage occurs, use the latest snapshot to restore the disk in the same zone.
• D.Configure the Compute Engine instances with an instance template for the application, and use a regional persistent disk for the application data. Whenever a zonal outage occurs, use the instance template to spin up the application in another region. Use the regional persistent disk for the application data,

Comment: *

Name: *

Email: *

Verification: *

Your company runs several databases on a single MySQL instance. They need to take backups of a specific database at regular intervals. The backup activity needs to complete as quickly as possible and cannot be allowed to impact disk performance.
How should you configure the storage?

• A.Mount additional persistent disk volumes onto each virtual machine (VM) instance in a RAID10 array and use LVM to create snapshots to send to Cloud Storage
• B.Configure a cron job to use the gcloud tool to take regular backups using persistent disk snapshots.
• C.Use gcsfise to mount a Google Cloud Storage bucket as a volume directly on the instance and write backups to the mounted location using mysqldump.
• D.Mount a Local SSD volume as the backup location. After the backup is complete, use gsutil to move the backup to Google Cloud Storage.

Comment: *

Name: *

Email: *

Verification: *

You have deployed several instances on Compute Engine. As a security requirement, instances cannot have a public IP address. There is no VPN connection between Google Cloud and your office, and you need to connect via SSH into a specific machine without violating the security requirements. What should you do?

• A.Configure Cloud NAT on the subnet where the instance is hosted. Create an SSH connection to the Cloud NAT IP address to reach the instance.
• B.Add all instances to an unmanaged instance group. Configure TCP Proxy Load Balancing with the instance group as a backend. Connect to the instance using the TCP Proxy IP.
• C.Configure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-secured Tunnel User. Use the gcloud command line tool to ssh into the instance.
• D.Create a bastion host in the network to SSH into the bastion host from your office location. From the bastion host, SSH into the desired instance.

Comment: *

Name: *

Email: *

Verification: *