You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources. Your export must meet the following requirements:
Export related logs for all projects in the Google Cloud organization.
Export logs in near real-time to an external SIEM.
What should you do? (Choose two.)

• A.Create a Log Sink at the organization level with a Pub/Sub destination.
• B.Create a Log Sink at the organization level with the includeChildren parameter, and set the destination to a Pub/Sub topic.
• C.Enable Data Access audit logs at the organization level to apply to all projects.
• D.Enable Google Workspace audit logs to be shared with Google Cloud in the Admin Console.
• E.Ensure that the SIEM processes the AuthenticationInfo field in the audit log entry to gather identity information.

Comment: *

Name: *

Email: *

Verification: *

A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?

• A.Cloud VPN
• B.Cloud Armor
• C.Cloud Identity-Aware Proxy
• D.Cloud Endpoints

Comment: *

Name: *

Email: *

Verification: *

In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard Which options should you recommend to meet the requirements?

• A.Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
• B.Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
• C.Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.
• D.Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.

Comment: *

Name: *

Email: *

Verification: *

A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?

• A.VPC Flow Logs
• B.Cloud Armor
• C.DNS Security Extensions
• D.Cloud Identity-Aware Proxy

Comment: *

Name: *

Email: *

Verification: *

In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)

• A.Access Policies
• B.Network Security
• C.Hardware
• D.Storage Encryption
• E.Boot

Comment: *

Name: *

Email: *

Verification: *