You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?

• A.Change the access control model for the bucket
• B.Update your sink with the correct bucket destination.
• C.Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
• D.Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.

Comment: *

Name: *

Email: *

Verification: *

A customer terminates an engineer and needs to make sure the engineer's Google account is automatically deprovisioned.
What should the customer do?

• A.Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
• B.Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
• C.Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
• D.Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.

Comment: *

Name: *

Email: *

Verification: *

Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users. You are required to:
Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity.
Disable any manually created users in Cloud Identity.
You have already configured the LDAP search attributes to include the users and security groups in scope for Google Cloud. What should you do next to complete this solution?

• A.1. Configure the LDAP search attributes to exclude manually created Cloud identity users not found in LDAP.
  2. Run GCDS after user and group lifecycle changes.
• B.1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP.
  2. Set up a recurring GCDS task.
• C.1. Configure the option to delete domain users not found in LDAP.
  2. Run GCDS after user and group lifecycle changes.
• D.1. Configure the option to suspend domain users not found in LDAP.
  2. Set up a recurring GCDS task.

Comment: *

Name: *

Email: *

Verification: *

A business unit at a multinational corporation signs up for GCP and starts moving workloads into GCP. The business unit creates a Cloud Identity domain with an organizational resource that has hundreds of projects.
Your team becomes aware of this and wants to take over managing permissions and auditing the domain resources.
Which type of access should your team grant to meet this requirement?

• A.Organization Administrator
• B.Security Reviewer
• C.Organization Role Administrator
• D.Organization Policy Administrator

Comment: *

Name: *

Email: *

Verification: *

An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?

• A.Use Forseti with Firewall filters to catch any unwanted configurations in production.
• B.Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
• C.Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
• D.All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.

Comment: *

Name: *

Email: *

Verification: *