An auditor for your organization wants to review how data in Google Cloud is being used. The auditor is most interested in seeing who has accessed data stored in Cloud Storage buckets. You need to help the auditor get access to the data they need. What should you do?
ATurn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.
BAssign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.
CAssign the appropriate permissions, and then use Cloud Monitoring to review metrics.
DUse the export logs API to provide the Admin Activity Audit Logs in the format they want.
0
Community Discussion
No comments yet. Be the first to start the discussion!
All development (dev) teams in your organization are located in the United States. Each dev team has its own Google Cloud project. You want to restrict access so that each dev team can only create cloud resources in the United States (US). What should you do?
ACreate a folder to contain all the dev projects. Create an organization policy to limit resources in US locations.
BCreate an organization to contain all the dev projects. Create an Identity and Access Management (IAM) policy to limit the resources in US regions.
CCreate an Identity and Access Management (IAM) policy to restrict the resources locations in the US. Apply the policy to all dev projects.
DCreate an Identity and Access Management (IAM) policy to restrict the resources locations in all dev projects. Apply the policy to all dev roles.
0
Community Discussion
No comments yet. Be the first to start the discussion!
You are building a multi-player gaming application that will store game information in a database. As the popularity of the application increases, you are concerned about delivering consistent performance. You need to ensure an optimal gaming performance for global users, without increasing the management complexity. What should you do?
AUse Cloud SQL database with cross-region replication to store game statistics in the EU, US, and APAC regions.
BUse Cloud Spanner to store user data mapped to the game statistics.
CUse BigQuery to store game statistics with a Redis on Memorystore instance in the front to provide global consistency.
DStore game statistics in a Bigtable database partitioned by username.
0
Community Discussion
No comments yet. Be the first to start the discussion!
Your organization enforces strict controls over access to Google Cloud projects. You need to allow your Site Reliability Engineers (SREs) to approve access requests submitted by the Google Cloud support team whenever an SRE opens a support case. Following Google-recommended practices, what should you do?
AAdd your SREs to roles/iam.roleAdmin role.
BAdd your SREs to roles/accessapproval.approver role.
CAdd your SREs to a group and then add this group to roles/iam.roleAdmin.role.
DAdd your SREs to a group and then add this group to roles/accessapproval.approver role.
0
Community Discussion
No comments yet. Be the first to start the discussion!
You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?
A
Use nslookup to get the IP address for storage.googleapis.com. 2. Negotiate with the security team to be able to give a public IP address to the servers. 3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
B
Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud. 2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance. 3. Configure your servers to use that instance as a proxy to access Cloud Storage.
C
Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine. 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend. 3. Configure your new instances to use this ILB as proxy.
D
Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.
0
Community Discussion
No comments yet. Be the first to start the discussion!
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
You have an application configured to locate its licensing server at the IP address 10.0.3.21. You need to deploy the licensing server on Compute Engine, and you must do so without changing the application's configuration, while ensuring the application can still reach the licensing server. What should you do?
AReserve the IP 10.0.3.21 as a static internal IP address using gcloud and assign it to the licensing server.
BReserve the IP 10.0.3.21 as a static public IP address using gcloud and assign it to the licensing server.
CUse the IP 10.0.3.21 as a custom ephemeral IP address and assign it to the licensing server.
DStart the licensing server with an automatic ephemeral IP address, and then promote it to a static internal IP address.
You are developing an internet of things (IoT) application that captures sensor data from multiple devices that have already been set up. You need to identify the global data storage product your company should use to store this data. You must ensure that the storage solution you choose meets your requirements of sub-millisecond latency. What should you do?
AStore the IoT data in Spanner. Use caches to speed up the process and avoid latencies.
BStore the IoT data in Bigtable.
CCapture IoT data in BigQuery datasets.
DStore the IoT data in Cloud Storage. Implement caching by using Cloud CDN.
You have created an application that is packaged into a Docker image. You want to deploy the Docker image as a workload on Google Kubernetes Engine. What should you do?
AUpload the image to Cloud Storage and create a Kubernetes Service referencing the image.
BUpload the image to Cloud Storage and create a Kubernetes Deployment referencing the image.
CUpload the image to Artifact Registry and create a Kubernetes Service referencing the image.
DUpload the image to Artifact Registry and create a Kubernetes Deployment referencing the image.
You want to cut GCP service costs for one division of your company, using as few steps as possible, by turning off all the services that are currently configured in an existing GCP project. What should you do?
A
Verify that you are assigned the Project Owners IAM role for this project. 2. Locate the project in the GCP console, click Shut down and then enter the project ID.
B
Verify that you are assigned the Project Owners IAM role for this project. 2. Switch to the project in the GCP console, locate the resources and delete them.
C
Verify that you are assigned the Organizational Administrator IAM role for this project. 2. Locate the project in the GCP console, enter the project ID and then click Shut down.
D
Verify that you are assigned the Organizational Administrators IAM role for this project. 2. Switch to the project in the GCP console, locate the resources and delete them.
Your team is running an on-premises ecommerce application. The application contains a complex set of microservices written in Python, and each microservice is running on Docker containers. Configurations are injected by using environment variables. You need to deploy your current application to a serverless Google Cloud cloud solution. What should you do?
AUse your existing CI/CD pipeline. Use the generated Docker images and deploy them to Cloud Run. Update the configurations and the required endpoints.
BUse your existing continuous integration and delivery (CI/CD) pipeline. Use the generated Docker images and deploy them to Cloud Function. Use the same configuration as on-premises.
CUse the existing codebase and deploy each service as a separate Cloud Function. Update the configurations and the required endpoints.
DUse your existing codebase and deploy each service as a separate Cloud Run. Use the same configurations as on-premises.
You need to provide a cost estimate for a Kubernetes cluster using the GCP pricing calculator for Kubernetes Engine. Your workload requires:
High IOPS
Use of disk snapshots
You begin by entering the number of nodes, average hours, and average days.
What should you do next?
AFill in local SSD. Fill in persistent disk storage and snapshot storage.
BFill in local SSD. Add estimated cost for cluster management.
CSelect Add GPUs. Fill in persistent disk storage and snapshot storage.
DSelect Add GPUs. Add estimated cost for cluster management.
A managed instance group has triggered an alert indicating that it failed to create new instances. You need to ensure the number of running instances stays at the level specified by the template so the application can handle expected traffic. What should you do?
ACreate an instance template that contains valid syntax which will be used by the instance group. Delete any persistent disks with the same name as instance names.
BCreate an instance template that contains valid syntax that will be used by the instance group. Verify that the instance name and persistent disk name values are not the same in the template.
CVerify that the instance template being used by the instance group contains valid syntax. Delete any persistent disks with the same name as instance names. Set the disks.autoDelete property to true in the instance template.
DDelete the current instance template and replace it with a new instance template. Verify that the instance name and persistent disk name values are not the same in the template. Set the disks.autoDelete property to true in the instance template.
You are storing sensitive information in a Cloud Storage bucket. For legal reasons, you need to be able to record all requests that read any of the stored data. What should you do to meet this requirement?
AEnable the Identity Aware Proxy API on the project.
BScan the bucket using the Data Loss Prevention API.
CAllow only a single Service Account access to read the data.
DEnable Data Access audit logs for the Cloud Storage API.
You installed the Google Cloud CLI on your workstation and set the proxy configuration. However, you are worried that your proxy credentials will be recorded in the gcloud CLI logs. You want to prevent your proxy credential from being logged. What should you do?
AConfigure username and password by using gcloud config set proxy/username and gcloud config set proxy/password commands.
BEncode username and password in sha256 encoding, and save in to a text file. Use filename as a value in the gcloud config set core/custom_ca_certs_file command.
CProvide values for CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY_PASSWORD in the gcloud CLI tool configuration file.
DSet the CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY_PASSWORD properties by using environment variables in your command line tool.
During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are only shared with users whose email addresses match your domain. You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?
ACreate a Cloud Scheduler task to regularly scan your projects and delete mismatched users.
BCreate a Cloud Scheduler task to regularly scan your resources and delete mismatched users.
CSet an organizational policy constraint to limit identities by domain to automatically remove mismatched users.
DSet an organizational policy constraint to limit identities by domain, and then retroactively remove the existing mismatched users
You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.
You check the status of the deployed pods and notice that one of them is still in PENDING status:
You want to find out why the pod is stuck in pending status. What should you do?
AReview details of the myapp-service Service object and check for error messages.
BReview details of the myapp-deployment Deployment object and check for error messages.
CReview details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.
DView logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.
An external member of your team needs list access to compute images and disks in one of your projects. You want to follow Google-recommended practices when you grant the required permissions to this user. What should you do?
ACreate a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level.
BCreate a custom role based on the Compute Image User role. Add the compute.disks.list to the includedPermissions field. Grant the custom role to the user at the project level.
CCreate a custom role based on the Compute Storage Admin role. Exclude unnecessary permissions from the custom role. Grant the custom role to the user at the project level.
DGrant the Compute Storage Admin role at the project level.
Your company intends to migrate its on-premises PostgreSQL database to Google Cloud. The workloads are demanding and require fast transactional and analytical performance. You need to choose a fully managed Google Cloud database service. The solution must also be capable of synchronous replication and storage-layer optimization. What should you do?
AMigrate the database to Cloud SQL for PostgreSQL by using Database Migration Service.
BUse the psql client installed on a Compute Engine instance. Connect to the Cloud SQL instance to perform the database migration.
CMigrate the database to AlloyDB for PostgreSQL by using Database Migration Service.
DCreate a Compute Engine instance. Install and configure PostgreSQL on the instance, and migrate the database.
Your organization currently manages user identities in Active Directory and wants to continue using Active Directory as the authoritative source of truth for those identities. At the same time, your organization wants full control over the Google accounts that employees use for all Google services, including your Google Cloud Platform (GCP) organization.
What should you do?
AUse Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
BUse the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
CExport users from Active Directory as a CSV and import them to Cloud Identity via the Admin Console.
DAsk each employee to create a Google account using self signup. Require that each employee use their company email address and password.
Your company operates in the European Economic Area (EEA) and will adopt Google Cloud for its workloads. Projects are presently organized in different folders. You must ensure that all resources to be deployed use Google Cloud locations within the EEA by using the Organization Policy Service resource locations constraint. What should you do?
AConfigure the policy at the folder level, and add all allowed locations to the policy.
BConfigure the policy at the organization level, and add all allowed locations to the policy.
CConfigure the policy at the folder level, and add all disallowed locations to the policy.
DConfigure the policy at the organization level, and add all disallowed locations to the policy.
You have been asked to create robust Virtual Private Network (VPN) connectivity between a new Virtual Private Cloud (VPC) and a remote site. Key requirements include dynamic routing, a shared address space of 10.19.0.1/22, and no overprovisioning of tunnels during a failover event. You want to follow Google- recommended practices to set up a high availability Cloud VPN. What should you do?
AUse a custom mode VPC network, configure static routes, and use active/passive routing.
BUse an automatic mode VPC network, configure static routes, and use active/active routing.
CUse a custom mode VPC network, use Cloud Router border gateway protocol (BGP) routes, and use active/passive routing.
DUse an automatic mode VPC network, use Cloud Router border gateway protocol (BGP) routes, and configure policy-based routing.
You have a Compute Engine instance hosting a production application. You want to receive an email if the instance consumes more than 90% of its CPU resources for more than 15 minutes. You want to use Google services. What should you do?
A
Create a consumer Gmail account. 2. Write a script that monitors the CPU usage. 3. When the CPU usage exceeds the threshold, have that script send an email using the Gmail account and smtp.gmail.com on port 25 as SMTP server.
B
Create a Cloud Monitoring Workspace and associate your Google Cloud Platform (GCP) project with it. 2. Create a Cloud Monitoring Alerting Policy that uses the threshold as a trigger condition. 3. Configure your email address in the notification channel.
C
Create a Cloud Monitoring Workspace and associate your GCP project with it. 2. Write a script that monitors the CPU usage and sends it as a custom metric to Cloud Monitoring. 3. Create an uptime check for the instance in Cloud Monitoring.
D
In Cloud Logging, create a logs-based metric to extract the CPU usage by using this regular expression: CPU Usage: ([0-9] {1,3})% 2. In Cloud Monitoring, create an Alerting Policy based on this metric. 3. Configure your email address in the notification channel.
You have made substantial changes to a complex Deployment Manager template and want to verify that the dependencies among all defined resources are properly satisfied before committing the changes to the project. You want to get feedback on your changes as quickly as possible. What should you do?
AUse granular logging statements within a Deployment Manager template authored in Python.
BMonitor activity of the Deployment Manager execution on the Stackdriver Logging page of the GCP Console.
CExecute the Deployment Manager template against a separate project with the same configuration, and monitor for failures.
DExecute the Deployment Manager template using the ג€"-preview option in the same project, and observe the state of interdependent resources.
You currently have a project for your App Engine application that is serving a development environment. Testing has completed successfully, and you now want to set up a new project to serve as your production environment. What should you do?
AUse gcloud to create the new project, and then deploy your application to the new project.
BUse gcloud to create the new project and to copy the deployed application to the new project.
CCreate a Deployment Manager configuration file that copies the current App Engine deployment into a new project.
DDeploy your application again using gcloud and specify the project parameter with the new project name to create the new project.
As the project owner of a GCP project, you want to delegate control to your colleagues so they can manage buckets and files in Cloud Storage, following Google-recommended practices for granting permissions. Which IAM role should you grant your colleagues?
Community Discussion