You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you utilize to accomplish this? (Choose two.)

• A.Client-side encryption
• B.Customer-supplied encryption keys
• C.External Key Manager
• D.Hardware Security Module
• E.Confidential Computing and Istio

Comment: *

Name: *

Email: *

Verification: *

A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.
What technique should the institution use?

• A.Use Cloud Storage as a federated Data Source.
• B.Use a Cloud Hardware Security Module (Cloud HSM).
• C.Customer-managed encryption keys (CMEK).
• D.Customer-supplied encryption keys (CSEK).

Comment: *

Name: *

Email: *

Verification: *

An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.
Which option meets the requirement of your team?

• A.Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.
• B.Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.
• C.Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.
• D.Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.

Comment: *

Name: *

Email: *

Verification: *

Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?

• A.1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
  2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
• B.1. Configure all running Web and App servers with respective service accounts.
  2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
• C.1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.
  2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
• D.1. Configure all running Web and App servers with respective network tags.
  2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

Comment: *

Name: *

Email: *

Verification: *

Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions.
What should you do?

• A.Change the load balancer backend configuration to use network endpoint groups instead of instance groups.
• B.Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.
• C.Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
• D.Create a Cloud VPN connection between the two regions, and enable Google Private Access.

Comment: *

Name: *

Email: *

Verification: *