Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?

• A.Compute Network User Role at the host project level.
• B.Compute Network User Role at the subnet level.
• C.Compute Shared VPC Admin Role at the host project level.
• D.Compute Shared VPC Admin Role at the service project level.

Comment: *

Name: *

Email: *

Verification: *

For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on "in- scope" Nodes only. These Nodes can only contain the "in-scope" Pods.
How should the organization achieve this objective?

• A.Run all in-scope Pods in the namespace "in-scope-pci".
• B.Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
• C.Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
• D.Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.

Comment: *

Name: *

Email: *

Verification: *

A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?

• A.Cloud Endpoints
• B.Cloud VPN
• C.Cloud Identity-Aware Proxy
• D.Cloud Armor

Comment: *

Name: *

Email: *

Verification: *

A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end-user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?

• A.Cloud Armor
• B.VPC Firewall Rules
• C.Cloud Identity and Access Management
• D.Cloud CDN

Comment: *

Name: *

Email: *

Verification: *

A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?

• A.Use Security Command Center to view all assets across the organization.
• B.Use Stackdriver to create a dashboard across all projects.
• C.Use Forseti Security to automate inventory snapshots.
• D.Use Resource Manager on the organization level.

Comment: *

Name: *

Email: *

Verification: *