GCP PCA Case Study

Anonymous users from all over the world access a public health information website hosted in an on-premises EHR data center. The servers that host this website are older, and users are complaining about sluggish response times. There has also been a recent increase of distributed denial-of-service attacks toward the website. The attacks always come from the same IP address ranges. EHR management has identified the public health information website as an easy, low risk application to migrate to Google Cloud. You need to improve access latency and provide a security solution that will prevent the denial-of-service traffic from entering your Virtual Private Cloud (VPC) network. What should you do?

• A. Deploy an external HTTP(S) load balancer, configure VPC firewall rules, and move the applications onto Compute Engine virtual machines​

• B. Deploy an external HTTP(S) load balancer, configure Google Cloud Armor, and move the application onto Compute Engine virtual machines.​

• C. Containerize the application and move it into Google Kubernetes Engine (GKE). Create a GKE service to expose the pods within the cluster, and set up a GKE network policy.​

• D. Containerize the application and move it into Google Kubernetes Engine (GKE). Create an internal load balancer to expose the pods outside the cluster, and configure Identity-Aware Proxy (IAP) for access.

 

• A. Provision Carrier Peering.​

• B. Provision a new Internet connection.​

• C. Provision a Partner Interconnect connection.​

• D. Provision a Dedicated Interconnect connection.

One of EHR’s healthcare customers is an internationally renowned research and hospital facility. Many of their patients are well-known public personalities. Sources both inside and outside have tried many times to obtain health information on these patients for malicious purposes. The hospital requires that patient information stored in Cloud Storage buckets not leave the geographic areas in which the buckets are hosted. You need to ensure that information stored in Cloud Storage buckets in the "europe-west2" region does not leave that area. What should you do?

• A. Encrypt the data in the application on-premises before the data is stored in the "europe-west2" region.​

• B. Enable Virtual Private Cloud Service Controls, and create a service perimeter around the Cloud Storage resources.​

• C. Assign the Identity and Access Management (IAM) "storage.objectViewer" role only to users and service accounts that need to use the data.​

• D. Create an access control list (ACL) that limits access to the bucket to authorized users only, and apply it to the buckets in the "europe-west2" region.

The EHR sales employees are a remote-based workforce that travels to different locations to do their jobs. Regardless of their location, the sales employees need to access web-based sales tools located in the EHR data center. EHR is retiring their current Virtual Private Network (VPN) infrastructure, and you need to move the web-based sales tools to a BeyondCorp access model. Each sales employee has a Google Workspace account and uses that account for single sign-on (SSO). What should you do?

• A. Create an Identity-Aware Proxy (IAP) connector that points to the sales tool application​

• B. Create a Google group for the sales tool application, and upgrade that group to a security group.​

• C. Deploy an external HTTP(S) load balancer and create a custom Cloud Armor policy for the sales tool application.​

• D. For every sales employee who needs access to the sales tool application, give their Google Workspace user account the predefined AppEngine Viewer role.

You are the data compliance officer for Mountkirk Games and must protect customers' personally identifiable information (PII). Mountkirk Games wants to make sure they can generate anonymized usage reports about their new game and delete PII data after a specific period of time. The solution should have minimal cost. You need to ensure compliance while meeting business and technical requirements. What should you do?

• A. Archive audit logs in Cloud Storage, and manually generate reports.​

• B. Write a Cloud Logging filter to export specific date ranges to Pub/Sub.​

• C. Archive audit logs in BigQuery, and generate reports using Google Data Studio​

• D. Archive user logs on a locally attached persistent disk, and cat them to a text file for auditing.

Mountkirk Games wants you to make sure their new gaming platform is being operated according to Google best practices. You want to verify that Google-recommended security best practices are being met while also providing the operations teams with the metrics they need. What should you do? (Choose two)

• A. Ensure that you aren’t running privileged containers.​

• B. Ensure that you are using obfuscated Tags on workloads.​

• C. Ensure that you are using the native logging mechanisms.​

• D. Ensure that workloads are not using securityContext to run as a group.​

• E. Ensure that each cluster is running GKE metering so each team can be charged for their usage.

Your new game running on Google Cloud is in public beta, and you want to design meaningful service level objectives (SLOs) before the game becomes generally available. What should you do?

• A. Define one SLO as 99.9% game server availability. Define the other SLO as less than 100-ms latency.​

• B. Define one SLO as service availability that is the same as Google Cloud's availability. Define the other SLO as 100-ms latency.​

• C. Define one SLO as 99% HTTP requests return the 2xx status code. Define the other SLO as 99% requests return within 100 ms.​

• D. Define one SLO as total uptime of the game server within a week. Define the other SLO as the mean response time of all HTTP requests that are less than 100 ms.

HRL wants you to help them bring existing recorded video content to new fans in emerging regions. Considering the HRL business and technical requirements, what should you do?

• A. Serve the video content directly from a multi-region Cloud Storage bucket.​

• B. Use Cloud CDN to cache the video content from HRL’s existing public cloud provider.​

• C. Use Apigee Edge to cache the video content from HRL’s existing public cloud provider.​

• D. Replicate the video content in Google Kubernetes Engine clusters in regions close to the fans.

You are the data compliance officer for TerramEarth and must protect customers' personally identifiable information (PII), like credit card information. TerramEarth wants to personalize product recommendations for its large industrial customers. You need to respect data privacy and deliver a solution. What should you do?

• A. Use AutoML to provide data to the recommendation service​

• B. Process PII data on-premises to keep the private information more secure.​

• C. Use the Cloud Data Loss Prevention (DLP) API to provide data to the recommendation service.​

• D. Manually build, train, and test machine learning models to provide product recommendations anonymously.