Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether your firewall rules are working properly. What should you do?

• A.In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.
• B.Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.
• C.Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.
• D.Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.

Comment: *

Name: *

Email: *

Verification: *

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?

• A.1. In BigQuery, select the related dataset.
  2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.
• B.1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
  2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
  3. Click Hide Matching Entries.
  4. Make sure the resulting list is empty.
• C.1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
  2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
  3. Click Show Matching Entries.
  4. Make sure the resulting list is empty.
• D.1. Go to the IAM section on the project.
  2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.

Comment: *

Name: *

Email: *

Verification: *

As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.
Which cost reduction options should you recommend?

• A.Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
• B.Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
• C.Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
• D.Use FindingLimits and TimespanContfig to sample data and minimize transformation units.

Comment: *

Name: *

Email: *

Verification: *

Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?

• A.Temporarily disable authentication on the Cloud Storage bucket.
• B.Use the undelete command to recover the deleted service account.
• C.Create a new service account with the same name as the deleted service account.
• D.Update the permissions of another existing service account and supply those credentials to the applications.

Comment: *

Name: *

Email: *

Verification: *

You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?

• A.1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project.
  2. Grant your Google Cloud project access to a supported external key management partner system.
• B.1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
  2. In Cloud KMS, grant your Google Cloud project access to use the key.
• C.1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system.
  2. In the external key management partner system, grant access for this key to use your Google Cloud project.
• D.1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
  2. In Cloud KMS, grant your Google Cloud project access to use the key.

Comment: *

Name: *

Email: *

Verification: *