You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)

• A.Cloud Identity
• B.SSO SAML as a third-party IdP
• C.OpenID Connect
• D.Identity-Aware Proxy
• E.Identity Platform

Comment: *

Name: *

Email: *

Verification: *

You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

• A.Use multi-factor authentication for admin access to the web application.
• B.Use only applications certified compliant with PA-DSS.
• C.Move the cardholder data environment into a separate GCP project.
• D.Use VPN for all connections between your office and cloud environments.

Comment: *

Name: *

Email: *

Verification: *

You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive data. Your solution has the following requirements:
* Schedule key rotation for sensitive data.
* Control which region the encryption keys for sensitive data are stored in.
* Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?

• A.Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
• B.Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.
• C.Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
• D.Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

Comment: *

Name: *

Email: *

Verification: *

Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)

• A.Public IP
• B.IP Forwarding
• C.Private Google Access
• D.Static routes
• E.IAM Network User Role

Comment: *

Name: *

Email: *

Verification: *

A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?

• A.Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.
• B.Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.
• C.Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.
• D.Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.

Comment: *

Name: *

Email: *

Verification: *