G-ACE - Part 9

You are performing a monthly security check of your Google Cloud environment and want to know who has access to view data stored in your Google Cloud Project. What should you?

• Enable Audit Logs for all APIs that are related to data storage.

• Review the IAM permissions for any role that allows for data access.

• Review the Identity-Aware Proxy settings for each resource.

• Create a Data Loss Prevention job.

Your company has embraced a hybrid cloud strategy where some of the applications are deployed on Google Cloud. A Virtual Private Network (VPN) tunnel connects your Virtual Private Cloud (VPC) in Google Cloud with your company's on-premises network. Multiple applications in Google Cloud need to connect to an on-premises database server, and you want to avoid having to change the IP configuration in all of your applications when the IP of the database changes. What should you do?

• Configure Cloud NAT for all subnets of your VPC to be used when egressing from the VM instances.

• Create a private zone on Cloud DNS, and configure the applications with the DNS name.

• Configure the IP of the database as custom metadata for each instance, and query the metadata server.

• Query the Compute Engine internal DNS from the applications to retrieve the IP of the database.

You have developed a containerized web application that will serve internal colleagues during business hours. You want to ensure that no costs are incurred outside of the hours the application is used. You have just created a new Google Cloud project and want to deploy the application. What should you do?

• Deploy the container on Cloud Run for Anthos, and set the minimum number of instances to zero.

• Deploy the container on Cloud Run (fully managed), and set the minimum number of instances to zero.

• Deploy the container on App Engine flexible environment with autoscaling, and set the value min_instances to zero in the app.yaml.

• Deploy the container on App Engine flexible environment with manual scaling, and set the value instances to zero in the app.yaml.

You have experimented with Google Cloud using your own credit card and expensed the costs to your company. Your company wants to streamline the billing process and charge the costs of your projects to their monthly invoice. What should you do?

• Grant the financial team the IAM role of Billing Account User on the billing account linked to your credit card.

• Set up BigQuery billing export and grant your financial department IAM access to query the data.

• Create a ticket with Google Billing Support to ask them to send the invoice to your company.

• Change the billing account of your projects to the billing account of your company.

You are running a data warehouse on BigQuery. A partner company is offering a recommendation engine based on the data in your data warehouse. The partner company is also running their application on Google Cloud. They manage the resources in their own project, but they need access to the BigQuery dataset in your project. You want to provide the partner company with access to the dataset. What should you do?

• Create a Service Account in your own project, and grant this Service Account access to BigQuery in your project.

• Create a Service Account in your own project, and ask the partner to grant this Service Account access to BigQuery in their project.

• Ask the partner to create a Service Account in their project, and have them give the Service Account access to BigQuery in their project.

• Ask the partner to create a Service Account in their project, and grant their Service Account access to the BigQuery dataset in your project.

Your web application has been running successfully on Cloud Run for Anthos. You want to evaluate an updated version of the application with a specific percentage of your production users (canary deployment). What should you do?

• Create a new service with the new version of the application. Split traffic between this version and the version that is currently running.

• Create a new revision with the new version of the application. Split traffic between this version and the version that is currently running.

• Create a new service with the new version of the application. Add an HTTP Load Balancer in front of both services.

• Create a new revision with the new version of the application. Add an HTTP Load Balancer in front of both revisions.

Your company developed a mobile game that is deployed on Google Cloud. Gamers are connecting to the game with their personal phones over the Internet. The game sends UDP packets to update the servers about the gamers' actions while they are playing in multiplayer mode. Your game backend can scale over multiple virtual machines (VMs), and you want to expose the VMs over a single IP address. What should you do?

• Configure an SSL Proxy load balancer in front of the application servers.

• Configure an Internal UDP load balancer in front of the application servers.

• Configure an External HTTP(s) load balancer in front of the application servers.

• Configure an External Network load balancer in front of the application servers.

You are working for a hospital that stores its medical images in an on-premises data room. The hospital wants to use Cloud Storage for archival storage of these images. The hospital wants an automated process to upload any new medical images to Cloud Storage. You need to design and implement a solution. What should you do?

• Create a Pub/Sub topic, and enable a Cloud Storage trigger for the Pub/Sub topic. Create an application that sends all medical images to the Pub/Sub topic.

• Deploy a Dataflow job from the batch template, Datastore to Cloud Storage. Schedule the batch job on the desired interval.

• Create a script that uses the gsutil command line interface to synchronize the on-premises storage with Cloud Storage. Schedule the script as a cron job.

• In the Cloud Console, go to Cloud Storage. Upload the relevant images to the appropriate bucket.

Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?

• Turn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.

• Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.

• Assign the appropriate permissions, and then use Cloud Monitoring to review metrics.

• Use the export logs API to provide the Admin Activity Audit Logs in the format they want.

You received a JSON file that contained a private key of a Service Account in order to get access to several resources in a Google Cloud project. You downloaded and installed the Cloud SDK and want to use this private key for authentication and authorization when performing gcloud commands. What should you do?

• Use the command gcloud auth login and point it to the private key.

• Use the command gcloud auth activate-service-account and point it to the private key.

• Place the private key file in the installation directory of the Cloud SDK and rename it to credentials.json.

• Place the private key file in your home directory and rename it to GOOGLE_APPLICATION_CREDENTIALS.