Your team wants to make sure Compute Engine instances running in your production project do not have public IP addresses. The frontend application Compute Engine instances will require public IPs. The product engineers have the Editor role to modify resources. Your team wants to enforce this requirement.
How should your team meet these requirements?

• A.Enable Private Access on the VPC network in the production project.
• B.Remove the Editor role and grant the Compute Admin IAM role to the engineers.
• C.Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.
• D.Set up a VPC network with two subnets: one with public IPs and one without public IPs.

Comment: *

Name: *

Email: *

Verification: *

A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates.
What should your team do?

• A.Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
• B.Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.
• C.Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
• D.Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.

Comment: *

Name: *

Email: *

Verification: *

Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?

• A.1. Configure all running Web and App servers with respective network tags.
  2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
• B.1. Configure all running Web and App servers with respective service accounts.
  2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
• C.1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
  2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
• D.1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.
  2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

Comment: *

Name: *

Email: *

Verification: *

Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?

• A.Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
• B.Use Security Health Analytics to determine user activity.
• C.Use the Logs Explorer to search for user activity.
• D.Use the Cloud Monitoring console to filter audit logs by user.

Comment: *

Name: *

Email: *

Verification: *

A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?

• A.VPC Flow Logs
• B.Cloud Armor
• C.DNS Security Extensions
• D.Cloud Identity-Aware Proxy

Comment: *

Name: *

Email: *

Verification: *