You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?

• A.1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project.
  2. Grant your Google Cloud project access to a supported external key management partner system.
• B.1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
  2. In Cloud KMS, grant your Google Cloud project access to use the key.
• C.1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system.
  2. In the external key management partner system, grant access for this key to use your Google Cloud project.
• D.1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
  2. In Cloud KMS, grant your Google Cloud project access to use the key.

Comment: *

Name: *

Email: *

Verification: *

You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:
Each business unit manages access controls for their own projects.
Each business unit manages access control permissions at scale.
Business units cannot access other business units' projects.
Users lose their access if they move to a different business unit or leave the company.
Users and access control permissions are managed by the on-premises directory service.
What should you do? (Choose two.)

• A.Use VPC Service Controls to create perimeters around each business unit's project.
• B.Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
• C.Group business units based on Organization Units (OUs) and manage permissions based on OUs.
• D.Organize projects in folders, and assign permissions to Google groups at the folder level.
• E.Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.

Comment: *

Name: *

Email: *

Verification: *

Which two implied firewall rules are defined on a VPC network? (Choose two.)

• A.A rule that allows all outbound connections
• B.A rule that denies all inbound connections
• C.A rule that blocks all inbound port 25 connections
• D.A rule that blocks all outbound connections
• E.A rule that allows all inbound port 80 connections

Comment: *

Name: *

Email: *

Verification: *

You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective. What should you do?

• A.Create a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.
• B.Configure your Compute Engine instances to use the Google Cloud's operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.
• C.Use a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.
• D.Configure a custom retention policy of 12 years on your Google Cloud's operations suite log bucket in the EUROPE-WEST1 region.

Comment: *

Name: *

Email: *

Verification: *

You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?

• A.Add the host project containing the Shared VPC to the service perimeter.
• B.Add the service project where the Compute Engine instances reside to the service perimeter.
• C.Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.
• D.Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.

Comment: *

Name: *

Email: *

Verification: *