A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?

• A.BigQuery datasets
• B.Cloud Storage buckets
• C.StackDriver logging
• D.Cloud Pub/Sub topics

Comment: *

Name: *

Email: *

Verification: *

In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

• A.App Engine
• B.Cloud Functions
• C.Compute Engine
• D.Google Kubernetes Engine
• E.Cloud Storage

Comment: *

Name: *

Email: *

Verification: *

A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects.
Which two steps should the company take to meet these requirements? (Choose two.)

• A.Create a Google Group for the Engineering team, and assign permissions at the folder level.
• B.Create a folder for each development and production environment.
• C.Create a project with multiple VPC networks for each environment.
• D.Create an Organizational Policy constraint for each folder environment.
• E.Create projects for each environment, and grant IAM rights to each engineering user.

Comment: *

Name: *

Email: *

Verification: *

Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether your firewall rules are working properly. What should you do?

• A.Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.
• B.Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.
• C.Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.
• D.In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.

Comment: *

Name: *

Email: *

Verification: *

You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?

• A.Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• B.Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• C.Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• D.Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network.
  Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.

Comment: *

Name: *

Email: *

Verification: *