You work for an organization in a regulated industry that has strict data protection requirements. The organization backs up their data in the cloud. To comply with data privacy regulations, this data can only be stored for a specific length of time and must be deleted after this specific period.
You want to automate the compliance with this regulation while minimizing storage costs. What should you do?

• A.Store the data in a persistent disk, and delete the disk at expiration time.
• B.Store the data in a Cloud Bigtable table, and set an expiration time on the column families.
• C.Store the data in a Cloud Storage bucket, and configure the bucket's Object Lifecycle Management feature.
• D.Store the data in a BigQuery table, and set the table's expiration time.

Comment: *

Name: *

Email: *

Verification: *

You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

• A.Use multi-factor authentication for admin access to the web application.
• B.Use only applications certified compliant with PA-DSS.
• C.Move the cardholder data environment into a separate GCP project.
• D.Use VPN for all connections between your office and cloud environments.

Comment: *

Name: *

Email: *

Verification: *

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project. How should you make an exception for your partner's domain while following the stated best practices?

• A.Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."
• B.Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service.
• C.Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.
• D.Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.

Comment: *

Name: *

Email: *

Verification: *

Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization.
Which logging export strategy should you use to meet the requirements?

• A.1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project.2. Process Cloud Storage objects in SIEM.
• B.1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM project.2. Process Cloud Storage objects in SIEM.
• C.1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project.2. Subscribe SIEM to the topic.
• D.1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project.2. Subscribe SIEM to the topic.

Comment: *

Name: *

Email: *

Verification: *

You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)

• A.Grant users the compuce.imageUser role in their own projects.
• B.Grant users the compuce.imageUser role in the OS image project.
• C.Store the image in every project that is spun up in your organization.
• D.Set up an image access organization policy constraint, and list the security team managed project in the projects allow list.
• E.Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.

Comment: *

Name: *

Email: *

Verification: *