You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?

• A.Add the host project containing the Shared VPC to the service perimeter.
• B.Add the service project where the Compute Engine instances reside to the service perimeter.
• C.Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.
• D.Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.

Comment: *

Name: *

Email: *

Verification: *

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project. How should you make an exception for your partner's domain while following the stated best practices?

• A.Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."
• B.Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service.
• C.Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.
• D.Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.

Comment: *

Name: *

Email: *

Verification: *

You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length. Which Google Cloud solution should you use?

• A.Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys
• B.Cloud Data Loss Prevention with format-preserving encryption
• C.Cloud Data Loss Prevention with deterministic encryption using AES-SIV
• D.Cloud Data Loss Prevention with cryptographic hashing

Comment: *

Name: *

Email: *

Verification: *

You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM.
What should you do?

• A.Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
  "user email address" as the attribute to facilitate one-way sync.
• B.Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
  "user email address" as the attribute to facilitate bidirectional sync.
• C.Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
• D.Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.

Comment: *

Name: *

Email: *

Verification: *

An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?

• A.Use Forseti with Firewall filters to catch any unwanted configurations in production.
• B.Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
• C.Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
• D.All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.

Comment: *

Name: *

Email: *

Verification: *