You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to resources. Which VPC Service Controls mode should you use?

• A.Dry run
• B.Enforced
• C.Native
• D.Cloud Run

Comment: *

Name: *

Email: *

Verification: *

An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?

• A.Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
• B.Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
• C.BigQuery using a data pipeline job with continuous updates via Cloud VPN
• D.Cloud Storage using a scheduled task and gsutil via Cloud Interconnect

Comment: *

Name: *

Email: *

Verification: *

Developers in an organization are prototyping a few applications on Google Cloud Platform (GCP) and are starting to store sensitive information on GCP. The developers are using their personal/consumer Gmail accounts to set up and manage their projects within GCP. A security engineer identifies this practice as a concern to the organization management because of the lack of centralized project management and access to the data being stored in these accounts.
Which solution should be used to resolve this concern?

• A.Enforce the setup of Security Keys as the 2SV method for those Gmail accounts.
• B.Set up Google Cloud Identity and require the developers to use those accounts for GCP work.
• C.Require the developers to log/store their Gmail passwords with the Security team.
• D.Enable logging on all GCP projects to track all developer activities.

Comment: *

Name: *

Email: *

Verification: *

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?

• A.Set up an ACL with OWNER permission to a scope of allUsers.
• B.Set up an ACL with READER permission to a scope of allUsers.
• C.Set up a default bucket ACL and manage access for users using IAM.
• D.Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

Comment: *

Name: *

Email: *

Verification: *

An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?

• A.Use Forseti with Firewall filters to catch any unwanted configurations in production.
• B.Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
• C.Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
• D.All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.

Comment: *

Name: *

Email: *

Verification: *