Your company has sensitive data in Cloud Storage buckets. Data analysts have Identity Access Management (IAM) permissions to read the buckets. You want to prevent data analysts from retrieving the data in the buckets from outside the office network. What should you do?

• A.1. Create a VPC Service Controls perimeter that includes the projects with the buckets.
  2. Create an access level with the CIDR of the office network.
• B.1. Create a firewall rule for all instances in the Virtual Private Cloud (VPC) network for source range.
  2. Use the Classless Inter-domain Routing (CIDR) of the office network.
• C.1. Create a Cloud Function to remove IAM permissions from the buckets, and another Cloud Function to add IAM permissions to the buckets.
  2. Schedule the Cloud Functions with Cloud Scheduler to add permissions at the start of business and remove permissions at the end of business.
• D.1. Create a Cloud VPN to the office network.
  2. Configure Private Google Access for on-premises hosts.

Comment: *

Name: *

Email: *

Verification: *

An application development team has come to you for advice. They are planning to write and deploy an HTTP(S) API using Go 1.12. The API will have a very unpredictable workload and must remain reliable during peaks in traffic. They want to minimize operational overhead for this application. Which approach should you recommend?

• A.Develop the application with containers, and deploy to Google Kubernetes Engine.
• B.Develop the application for App Engine standard environment.
• C.Use a Managed Instance Group when deploying to Compute Engine.
• D.Develop the application for App Engine flexible environment, using a custom runtime.

Comment: *

Name: *

Email: *

Verification: *

For this question, refer to the Cymbal Retail case study. Cymbal wants you to connect their on-premises systems to Google Cloud while maintaining secure communication between their on-premises and cloud environments You want to follow Google ' s recommended approach to ensure the most secure and manageable solution. What should you do?

• A.Use a bastion host to provide secure access lo Google Cloud resources from Cymbal ' s on-premises systems.
• B.Configure a static VPN connection using SSH tunnels to connect the on-premises systems to Google Cloud
• C.Configure a Cloud VPN gateway and establish a VPN tunnel Configure firewall rules to restrict access to specific resources and services based on IP addresses and ports.
• D.Use Google Cloud ' s VPC peering to connect Cymbal ' s on-premises network to Google Cloud.

Comment: *

Name: *

Email: *

Verification: *

JencoMart has decided to migrate user profile storage to Google Cloud Datastore and the application servers to Google Compute Engine (GCE). During the migration, the existing infrastructure will need access to Datastore to upload the data.
What service account key-management strategy should you recommend?

• A.Provision service account keys for the on-premises infrastructure and for the GCE virtual machines (VMs)
• B.Authenticate the on-premises infrastructure with a user account and provision service account keys for the VMs
• C.Provision service account keys for the on-premises infrastructure and use Google Cloud Platform (GCP) managed keys for the VMs
• D.Deploy a custom authentication service on GCE/Google Kubernetes Engine (GKE) for the on-premises infrastructure and use GCP managed keys for the VMs

Comment: *

Name: *

Email: *

Verification: *

You need to deploy a stateful workload on Google Cloud. The workload can scale horizontally, but each instance needs to read and write to the same POSIX filesystem. At high load, the stateful workload needs to support up to 100 MB/s of writes. What should you do?

• A.Use a persistent disk for each instance.
• B.Use a regional persistent disk for each instance.
• C.Create a Cloud Filestore instance and mount it in each instance.
• D.Create a Cloud Storage bucket and mount it in each instance using gcsfuse.

Comment: *

Name: *

Email: *

Verification: *