CertyIQ - GACE - pt 7

You are working with a user to set up an application in a new VPC behind a firewall. The user is concerned about data egress. You want to configure the fewest open egress ports. What should you do?

• Set up a low-priority (65534) rule that blocks all egress and a high-priority rule (1000) that allows only the appropriate ports.

• Set up a high-priority (1000) rule that pairs both ingress and egress ports.

• Set up a high-priority (1000) rule that blocks all egress and a low-priority (65534) rule that allows only the appropriate ports.

• Set up a high-priority (1000) rule to allow the appropriate ports.

Your company runs its Linux workloads on Compute Engine instances. Your company will be working with a new operations partner that does not use Google Accounts. You need to grant access to the instances to your operations partner so they can maintain the installed tooling. What should you do?

• Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a Cloud IAP Tunnel User.

• Tag all the instances with the same network tag. Create a firewall rule in the VPC to grant TCP access on port 22 for traffic from the operations partner to instances with the network tag.

• Set up Cloud VPN between your Google Cloud VPC and the internal network of the operations partner.

• Ask the operations partner to generate SSH key pairs, and add the public keys to the VM instances.

You have created a code snippet that should be triggered whenever a new file is uploaded to a Cloud Storage bucket. You want to deploy this code snippet. What should you do?

• Use App Engine and configure Cloud Scheduler to trigger the application using Pub/Sub.

• Use Cloud Functions and configure the bucket as a trigger resource.

• Use Google Kubernetes Engine and configure a CronJob to trigger the application using Pub/Sub.

• Use Dataflow as a batch job, and configure the bucket as a data source.

You have been asked to set up Object Lifecycle Management for objects stored in storage buckets. The objects are written once and accessed frequently for 30 days. After 30 days, the objects are not read again unless there is a special need. The objects should be kept for three years, and you need to minimize cost. What should you do?

• Set up a policy that uses Nearline storage for 30 days and then moves to Archive storage for three years.

• Set up a policy that uses Standard storage for 30 days and then moves to Archive storage for three years.

• Set up a policy that uses Nearline storage for 30 days, then moves the Coldline for one year, and then moves to Archive storage for two years.

• Set up a policy that uses Standard storage for 30 days, then moves to Coldline for one year, and then moves to Archive storage for two years.

You are storing sensitive information in a Cloud Storage bucket. For legal reasons, you need to be able to record all requests that read any of the stored data. You want to make sure you comply with these requirements. What should you do?

• Enable the Identity Aware Proxy API on the project.

• Scan the bucket using the Data Loss Prevention API.

• Allow only a single Service Account access to read the data.

• Enable Data Access audit logs for the Cloud Storage API.

You are the team lead of a group of 10 developers. You provided each developer with an individual Google Cloud Project that they can use as their personal sandbox to experiment with different Google Cloud solutions. You want to be notified if any of the developers are spending above $500 per month on their sandbox environment. What should you do?

• Create a single budget for all projects and configure budget alerts on this budget.

• Create a separate billing account per sandbox project and enable BigQuery billing exports. Create a Data Studio dashboard to plot the spending per billing account.

• Create a budget per project and configure budget alerts on all of these budgets.

• Create a single billing account for all sandbox projects and enable BigQuery billing exports. Create a Data Studio dashboard to plot the spending per project.

You are deploying a production application on Compute Engine. You want to prevent anyone from accidentally destroying the instance by clicking the wrong button. What should you do?

• Disable the flag Delete boot disk when instance is deleted.

• Enable delete protection on the instance.

• Disable Automatic restart on the instance.

• Enable Preemptibility on the instance.

Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Googlerecommended practices. What should you do?

• Grant all members of the DevOps team the role of Project Editor on the organization level.

• Grant all members of the DevOps team the role of Project Editor on the production project.

• Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the production project.

• Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the organization level.

• Build a lifecycle policy to delete Cloud Storage objects after 45 days.

• Use signed URLs to allow suppliers limited time access to store their objects

• Set up an SFTP server for your application, and create a separate user for each supplier.

• Build a Cloud function that triggers a timer of 45 days to delete objects that have expired.

• Develop a script that loops through all Cloud Storage buckets and deletes any buckets that are older than 45 days.

Your company wants to standardize the creation and management of multiple Google Cloud resources using Infrastructure as Code. You want to minimize the amount of repetitive code needed to manage the environment. What should you do?

• Develop templates for the environment using Cloud Deployment Manager.

• Use curl in a terminal to send a REST request to the relevant Google API for each individual resource.

• Use the Cloud Console interface to provision and manage all related resources.

• Create a bash script that contains all requirement steps as gcloud commands.