You are deploying your application on a Compute Engine instance that communicates with Cloud SQL. You will use Cloud SQL Proxy to allow your application to communicate to the database using the service account associated with the application's instance. You want to follow the Google-recommended best practice of providing minimum access for the role assigned to the service account. What should you do?

• A.Assign the Cloud SQL Client role.
• B.Assign the Project Editor role.
• C.Assign the Project Owner role.
• D.Assign the Cloud SQL Editor role.

Comment: *

Name: *

Email: *

Verification: *

You are developing a microservice-based application that will run on Google Kubernetes Engine (GKE).
Some of the services need to access different Google Cloud APIs. How should you set up authentication of these services in the cluster following Google-recommended best practices? (Choose two.)

• A.Use the service account attached to the GKE node.
• B.Enable Workload Identity in the cluster via the gcloud command-line tool.
• C.Access the Google service account keys from a secret management service.
• D.Store the Google service account keys in a central secret management service.
• E.Use gcloud to bind the Kubernetes service account and the Google service account using roles/iam.workloadIdentity.

Comment: *

Name: *

Email: *

Verification: *

You are developing an HTTP API hosted on a Compute Engine virtual machine instance that needs to be invoked by multiple clients within the same Virtual Private Cloud (VPC). You want clients to be able to get the IP address of the service.
What should you do?

• A.Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule.
  Then, define an A record in Cloud DNS. Clients should use the name of the A record to connect to the service.
• B.Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule.
  Clients should use this IP address to connect to the service.
• C.Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url
  https://[API_NAME]/[API_VERSION]/.
• D.Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url
  https://[INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal/.

Comment: *

Name: *

Email: *

Verification: *

HipLocal wants to improve the resilience of their MySQL deployment, while also meeting their business and technical requirements.
Which configuration should they choose?

• A.Replace the current single instance MySQL instance with Cloud SQL, and configure high availability.
• B.Replace the current single instance MySQL instance with Cloud SQL, and Google provides redundancy without further configuration.
• C.Use the current single instance MySQL on Compute Engine, and replicate the data to Cloud SQL in an external master configuration.
• D.Use the current single instance MySQL on Compute Engine and several read-only MySQL servers on Compute Engine.

Comment: *

Name: *

Email: *

Verification: *

Your team is developing an application in Google Cloud that executes with user identities maintained by Cloud Identity. Each of your application's users will have an associated Pub/Sub topic to which messages are published, and a Pub/Sub subscription where the same user will retrieve published messages. You need to ensure that only authorized users can publish and subscribe to their own specific Pub/Sub topic and subscription. What should you do?

• A.Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level.
• B.Grant the user identity a custom role that contains the pubsub.topics.create and pubsub.subscriptions.create permissions.
• C.Configure the application to run as a service account that has the pubsub.publisher and pubsub.subscriber roles.
• D.Grant the user identity the pubsub.publisher and pubsub.subscriber roles at the project level.

Comment: *

Name: *

Email: *

Verification: *