You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:
Each business unit manages access controls for their own projects.
Each business unit manages access control permissions at scale.
Business units cannot access other business units' projects.
Users lose their access if they move to a different business unit or leave the company.
Users and access control permissions are managed by the on-premises directory service.
What should you do? (Choose two.)

• A.Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
• B.Group business units based on Organization Units (OUs) and manage permissions based on OUs.
• C.Use VPC Service Controls to create perimeters around each business unit's project.
• D.Organize projects in folders, and assign permissions to Google groups at the folder level.
• E.Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.

Comment: *

Name: *

Email: *

Verification: *

A company's application is deployed with a user-managed Service Account key. You want to use Google- recommended practices to rotate the key.
What should you do?

• A.Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam- account=IAM_ACCOUNT.
• B.Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam- account=IAM_ACCOUNT --key=NEW_KEY.
• C.Create a new key, and use the new key in the application. Delete the old key from the Service Account.
• D.Create a new key, and use the new key in the application. Store the old key on the system as a backup key.

Comment: *

Name: *

Email: *

Verification: *

Which two implied firewall rules are defined on a VPC network? (Choose two.)

• A.A rule that blocks all inbound port 25 connections
• B.A rule that allows all outbound connections
• C.A rule that denies all inbound connections
• D.A rule that allows all inbound port 80 connections
• E.A rule that blocks all outbound connections

Comment: *

Name: *

Email: *

Verification: *

You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts.
Which two actions should you take? (Choose two.)

• A.Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity.
• B.Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.
• C.Send an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
• D.Use the Google Admin console to view which managed users are using a personal account for their recovery email.
• E.Add users to your managed Google account and force users to change the email addresses associated with their personal accounts.

Comment: *

Name: *

Email: *

Verification: *

In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)

• A.Hardware
• B.Network Security
• C.Storage Encryption
• D.Access Policies
• E.Boot

Comment: *

Name: *

Email: *

Verification: *