You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data Specifically, your company is concerned about internal Google employees' ability to access your company's data on Google Cloud. What solution should you propose?

• A.Use Google's Identity and Access Management (IAM) service to manage access controls on Google Cloud.
• B.Enable Admin activity logs to monitor access to resources.
• C.Enable Access Transparency logs with Access Approval requests for Google employees.
• D.Use customer-managed encryption keys.

Comment: *

Name: *

Email: *

Verification: *

A customer needs to rely on their existing user directory with the requirements of native authentication against it when developing for Google Cloud Platform (GCP). They want to leverage their existing tooling and functionality to gather insight on user activity from a familiar interface. Which action should you take to meet the customer's requirements?

• A.Provision users into Cloud Identity using Just-in-Time SAML 2.0 user provisioning with the customer User Directory as source.
• B.Configure Cloud Identity as a SAML 2.0 Service Provider, using the customer's User Directory as the Identity Provider.
• C.Configure and enforce 2-Step Verification in Cloud Identity for all Super Admins.
• D.Configure a third-party IdP (Octa or Ping Federate) to manage authentication.

Comment: *

Name: *

Email: *

Verification: *

You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?

• A.Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• B.Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• C.Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• D.Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.

Comment: *

Name: *

Email: *

Verification: *

A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet.
Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?

• A.Cloud Identity-Aware Proxy
• B.Cloud VPN
• C.Cloud Armor
• D.Cloud Endpoints

Comment: *

Name: *

Email: *

Verification: *

Your company is deploying their applications on Google Kubernetes Engine. You want to follow Google-recommended practices. What should you do to ensure that the container images used for new deployments contain the latest security patches?

• A.Use Google-managed base images for all containers.
• B.Use Container Analysis to detect vulnerabilities in images.
• C.Use an update script as part of every container image startup.
• D.Use exclusively private images in Container Registry.

Comment: *

Name: *

Email: *

Verification: *