A customer is collaborating with another company to build an application on Compute Engine. The customer is building the application tier in their GCP Organization, and the other company is building the storage tier in a different GCP Organization. This is a 3-tier web application. Communication between portions of the application must not traverse the public internet by any means.
Which connectivity option should be implemented?

• A.VPC peering
• B.Cloud VPN
• C.Cloud Interconnect
• D.Shared VPC

Comment: *

Name: *

Email: *

Verification: *

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?

• A.Set up an ACL with OWNER permission to a scope of allUsers.
• B.Set up an ACL with READER permission to a scope of allUsers.
• C.Set up a default bucket ACL and manage access for users using IAM.
• D.Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

Comment: *

Name: *

Email: *

Verification: *

Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead. What should you do?

• A.Use Cloud External Key Manager to delete specific encryption keys.
• B.Use customer-managed encryption keys to delete specific encryption keys.
• C.Use Google default encryption to delete specific encryption keys.
• D.Use client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises

Comment: *

Name: *

Email: *

Verification: *

Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?

• A.Use Security Health Analytics to determine user activity.
• B.Use the Cloud Monitoring console to filter audit logs by user.
• C.Use the Logs Explorer to search for user activity.
• D.Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.

Comment: *

Name: *

Email: *

Verification: *

You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?

• A.PCI DSS Requirements and Security Assessment Procedures
• B.Google Cloud Platform: Customer Responsibility Matrix
• C.Product documentation for Compute Engine
• D.PCI SSC Cloud Computing Guidelines

Comment: *

Name: *

Email: *

Verification: *