Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization.
Which logging export strategy should you use to meet the requirements?

• A.1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project.
  2. Subscribe SIEM to the topic.
• B.1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project.
  2. Process Cloud Storage objects in SIEM.
• C.1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project.
  2. Subscribe SIEM to the topic.
• D.1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM project.
  2. Process Cloud Storage objects in SIEM.

Comment: *

Name: *

Email: *

Verification: *

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?

• A.1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
  2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
  3. Click Hide Matching Entries.
  4. Make sure the resulting list is empty.
• B.1. In BigQuery, select the related dataset.
  2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.
• C.1. Go to the IAM section on the project.
  2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.
  Section: (none)
  Explanation
• D.1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
  2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
  3. Click Show Matching Entries.
  4. Make sure the resulting list is empty.

Comment: *

Name: *

Email: *

Verification: *

You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google-recommended practices.
What should you do?

• A.Use a dedicated G Suite Admin account, and authenticate the application's operations with these G Suite credentials.
• B.Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.
• C.Create a new Service account, and give all application users the role of Service Account User.
• D.Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.

Comment: *

Name: *

Email: *

Verification: *

A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?

• A.Use Cloud Build to build the container images.
• B.Build small containers using small base images.
• C.Delete non-used versions from Container Registry.
• D.Use a Continuous Delivery tool to deploy the application.

Comment: *

Name: *

Email: *

Verification: *

Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?

• A.Cloud NAT
• B.Cloud DNS with DNSSEC
• C.Google Cloud Armor
• D.HTTP(S) Load Balancing

Comment: *

Name: *

Email: *

Verification: *