You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

• A.compute.restrictSharedVpcHostProjects
• B.compute.restrictSharedVpcSubnetworks
• C.compute.restrictXpnProjectLienRemoval
• D.compute.sharedReservationsOwnerProjects

Comment: *

Name: *

Email: *

Verification: *

As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.
Which cost reduction options should you recommend?

• A.Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
• B.Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
• C.Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
• D.Use FindingLimits and TimespanContfig to sample data and minimize transformation units.

Comment: *

Name: *

Email: *

Verification: *

You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types. What should you do?

• A.Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
• B.Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
• C.Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
• D.Encrypt non-sensitive data and sensitive data with Cloud Key Management Service

Comment: *

Name: *

Email: *

Verification: *

A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?

• A.BigQuery datasets
• B.Cloud Storage buckets
• C.StackDriver logging
• D.Cloud Pub/Sub topics

Comment: *

Name: *

Email: *

Verification: *

A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?

• A.Use Cloud Build to build the container images.
• B.Build small containers using small base images.
• C.Delete non-used versions from Container Registry.
• D.Use a Continuous Delivery tool to deploy the application.

Comment: *

Name: *

Email: *

Verification: *