Applications often require access to "secrets" - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)

• A.Agent logs
• B.Data Access logs
• C.VPC Flow logs
• D.System Event logs
• E.Admin Activity logs

Comment: *

Name: *

Email: *

Verification: *

An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses Which solution should your team implement to meet these requirements?

• A.Cloud Armor
• B.Network Load Balancing
• C.SSL Proxy Load Balancing
• D.NAT Gateway

Comment: *

Name: *

Email: *

Verification: *

A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior.
What should you do to meet these requirements?

• A.Create a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.
• B.Create a Project per department under the Organization. For each department's Project, assign the Project Viewer role to the Google Group related to that department.
• C.Create a Project per department under the Organization. For each department's Project, assign the Project Browser role to the Google Group related to that department.
• D.Create a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.

Comment: *

Name: *

Email: *

Verification: *

You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?

• A.Query Data Access logs.
• B.Query Admin Activity logs.
• C.Query Access Transparency logs.
• D.Query Stackdriver Monitoring Workspace.

Comment: *

Name: *

Email: *

Verification: *

Your team creates an ingress firewall rule to allow SSH access from their corporate IP range to a specific bastion host on Compute Engine. Your team wants to make sure that this firewall rule cannot be used by unauthorized engineers who may otherwise have access to manage VMs in the development environment. What should your team do to meet this requirement?

• A.Create the firewall rule with a target of a network tag. Centrally manage access to the tag.
• B.Create the firewall rule with a target of a service account. Centrally manage access to the service account.
• C.Create the firewall rule in a Shared VPC with a target of a network tag.
• D.Create the firewall rule in a Shared VPC with a target of a specific subnet.

Comment: *

Name: *

Email: *

Verification: *