NEW QUESTION 1
You are managing a Data Warehouse on BigQuery. An external auditor will review your company's processes, and multiple external consultants will need view access to the data. You need to provide them with view access while following Google-recommended practices. What should you do?

• A. Grant each individual external consultant the role of BigQuery Editor
• B. Grant each individual external consultant the role of BigQuery Viewer
• C. Create a Google Group that contains the consultants and grant the group the role of BigQuery Editor
• D. Create a Google Group that contains the consultants, and grant the group the role of BigQuery Viewer

Answer: D

NEW QUESTION 2
Your organization has user identities in Active Directory. Your organization wants to use Active Directory as their source of truth for identities. Your organization wants to have full control over the Google accounts used by employees for all Google services, including your Google Cloud Platform (GCP) organization. What should you do?

• A. Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
• B. Use the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
• C. Export users from Active Directory as a CSV and import them to Cloud Identity via the Admin Console.
• D. Ask each employee to create a Google account using self signu
• E. Require that each employee use their company email address and password.

Answer: A

NEW QUESTION 3
Your company uses Cloud Storage to store application backup files for disaster recovery purposes. You want to follow Google’s recommended practices. Which storage option should you use?

• A. Multi-Regional Storage
• B. Regional Storage
• C. Nearline Storage
• D. Coldline Storage

Answer: D

NEW QUESTION 4
You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.

You check the status of the deployed pods and notice that one of them is still in PENDING status:

You want to find out why the pod is stuck in pending status. What should you do?

• A. Review details of the myapp-service Service object and check for error messages.
• B. Review details of the myapp-deployment Deployment object and check for error messages.
• C. Review details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.
• D. View logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.

Answer: C

NEW QUESTION 5
You need to run an important query in BigQuery but expect it to return a lot of records. You want to find out how much it will cost to run the query. You are using on-demand pricing. What should you do?

• A. Arrange to switch to Flat-Rate pricing for this query, then move back to on-demand.
• B. Use the command line to run a dry run query to estimate the number of bytes rea
• C. Then convert that bytes estimate to dollars using the Pricing Calculator.
• D. Use the command line to run a dry run query to estimate the number of bytes returne
• E. Then convert that bytes estimate to dollars using the Pricing Calculator.
• F. Run a select count (*) to get an idea of how many records your query will look throug
• G. Then convert that number of rows to dollars using the Pricing Calculator.

Answer: B

NEW QUESTION 6
You created several resources in multiple Google Cloud projects. All projects are linked to different billing accounts. To better estimate future charges, you want to have a single visual representation of all costs incurred. You want to include new cost data as soon as possible. What should you do?

• A. Configure Billing Data Export to BigQuery and visualize the data in Data Studio.
• B. Visit the Cost Table page to get a CSV export and visualize it using Data Studio.
• C. Fill all resources in the Pricing Calculator to get an estimate of the monthly cost.
• D. Use the Reports view in the Cloud Billing Console to view the desired cost information.

Answer: A

NEW QUESTION 7
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.

You want to resolve the issue. What should you do?

• A. Option A
• B. Option B
• C. Option C
• D. Option D

Answer: D

NEW QUESTION 8
You need to update a deployment in Deployment Manager without any resource downtime in the deployment. Which command should you use?

• A. gcloud deployment-manager deployments create --config <deployment-config-path>
• B. gcloud deployment-manager deployments update --config <deployment-config-path>
• C. gcloud deployment-manager resources create --config <deployment-config-path>
• D. gcloud deployment-manager resources update --config <deployment-config-path>

Answer: B

NEW QUESTION 9
Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention. What should you do?

• A. Create an export to the sink that saves logs from Cloud Audit to BigQuery.
• B. Create an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket.
• C. Write a custom script that uses logging API to copy the logs from Stackdriver logs to BigQuery.
• D. Export these logs to Cloud Pub/Sub and write a Cloud Dataflow pipeline to store logs to Cloud SQL.

Answer: A

NEW QUESTION 10
You have just created a new project which will be used to deploy a globally distributed application. You will use Cloud Spanner for data storage. You want to create a Cloud Spanner instance. You want to perform the first step in preparation of creating the instance. What should you do?

• A. Grant yourself the IAM role of Cloud Spanner Admin
• B. Create a new VPC network with subnetworks in all desired regions
• C. Configure your Cloud Spanner instance to be multi-regional
• D. Enable the Cloud Spanner API

Answer: C

NEW QUESTION 11
Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below.

Each tier has a service account that is associated with all instances within it. You need to enable communication on TCP port 8080 between tiers as follows:
• Instances in tier #1 must communicate with tier #2.
• Instances in tier #2 must communicate with tier #3. What should you do?

• A. 1. Create an ingress firewall rule with the following settings:• Targets: all instances• Source filter: IP ranges (with the range set to 10.0.2.0/24)• Protocols: allow all2. Create an ingress firewall rule with the following settings:• Targets: all instances• Source filter: IP ranges (with the range set to 10.0.1.0/24)•Protocols: allow all
• B. 1. Create an ingress firewall rule with the following settings:• Targets: all instances with tier #2 service account• Source filter: all instances with tier #1 service account• Protocols: allow TCP:80802. Create an ingress firewall rule with the following settings:• Targets: all instances with tier #3 service account• Source filter: all instances with tier #2 service account• Protocols: allow TCP: 8080
• C. 1. Create an ingress firewall rule with the following settings:• Targets: all instances with tier #2 service account• Source filter: all instances with tier #1 service account• Protocols: allow all2. Create an ingress firewall rule with the following settings:• Targets: all instances with tier #3 service account• Source filter: all instances with tier #2 service account• Protocols: allow all
• D. 1. Create an egress firewall rule with the following settings:• Targets: all instances• Source filter: IP ranges (with the range set to 10.0.2.0/24)• Protocols: allow TCP: 80802. Create an egress firewall rule with the following settings:• Targets: all instances• Source filter: IP ranges (with the range set to 10.0.1.0/24)• Protocols: allow TCP: 8080

Answer: B

NEW QUESTION 12
You have sensitive data stored in three Cloud Storage buckets and have enabled data access logging. You want to verify activities for a particular user for these buckets, using the fewest possible steps. You need to verify the addition of metadata labels and which files have been viewed from those buckets. What should you do?

• A. Using the GCP Console, filter the Activity log to view the information.
• B. Using the GCP Console, filter the Stackdriver log to view the information.
• C. View the bucket in the Storage section of the GCP Console.
• D. Create a trace in Stackdriver to view the information.

Answer: A

NEW QUESTION 13
You are building an application that processes data files uploaded from thousands of suppliers. Your primary goals for the application are data security and the expiration of aged data. You need to design the application to:
•Restrict access so that suppliers can access only their own data.
•Give suppliers write access to data only for 30 minutes.
•Delete data that is over 45 days old.
You have a very short development cycle, and you need to make sure that the application requires minimal maintenance. Which two strategies should you use? (Choose two.)

• A. Build a lifecycle policy to delete Cloud Storage objects after 45 days.
• B. Use signed URLs to allow suppliers limited time access to store their objects.
• C. Set up an SFTP server for your application, and create a separate user for each supplier.
• D. Build a Cloud function that triggers a timer of 45 days to delete objects that have expired.
• E. Develop a script that loops through all Cloud Storage buckets and deletes any buckets that are older than 45 days.

Answer: AE

NEW QUESTION 14
You are developing a new web application that will be deployed on Google Cloud Platform. As part of your release cycle, you want to test updates to your application on a small portion of real user traffic. The majority of the users should still be directed towards a stable version of your application. What should you do?

• A. Deploy me application on App Engine For each update, create a new version of the same service Configure traffic splitting to send a small percentage of traffic to the new version
• B. Deploy the application on App Engine For each update, create a new service Configure traffic splitting to send a small percentage of traffic to the new service.
• C. Deploy the application on Kubernetes Engine For a new release, update the deployment to use the new version
• D. Deploy the application on Kubernetes Engine For a now release, create a new deployment for the new version Update the service e to use the now deployment.

Answer: A

NEW QUESTION 15
Your organization uses Active Directory (AD) to manage user identities. Each user uses this identity for federated access to various on-premises systems. Your security team has adopted a policy that requires users to log into Google Cloud with their AD identity instead of their own login. You want to follow the
Google-recommended practices to implement this policy. What should you do?

• A. Sync Identities with Cloud Directory Sync, and then enable SAML for single sign-on
• B. Sync Identities in the Google Admin console, and then enable Oauth for single sign-on
• C. Sync identities with 3rd party LDAP sync, and then copy passwords to allow simplified login with (he same credentials
• D. Sync identities with Cloud Directory Sync, and then copy passwords to allow simplified login with the same credentials.

Answer: A

NEW QUESTION 16
Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?

• A. Add the user to roles/iam.roleAdmin role.
• B. Add the user to roles/iam.securityAdmin role.
• C. Add the user to roles/iam.serviceAccountUser role.
• D. Add the user to roles/iam.serviceAccountAdmin role.

Answer: C

NEW QUESTION 17
You need to reduce GCP service costs for a division of your company using the fewest possible steps. You need to turn off all configured services in an existing GCP project. What should you do?

• A. * 1. Verify that you are assigned the Project Owners IAM role for this project.* 2. Locate the project in the GCP console, click Shut down and then enter the project ID.
• B. * 1. Verify that you are assigned the Project Owners IAM role for this project.* 2. Switch to the project in the GCP console, locate the resources and delete them.
• C. 1. Verify that you are assigned the Organizational Administrator IAM role for this project.* 2. Locate the project in the GCP console, enter the project ID and then click Shut down.
• D. * 1. Verify that you are assigned the Organizational Administrators IAM role for this project.* 2. Switch to the project in the GCP console, locate the resources and delete them.

Answer: C

NEW QUESTION 18
You have a Compute Engine instance hosting an application used between 9 AM and 6 PM on weekdays. You want to back up this instance daily for disaster recovery purposes. You want to keep the backups for 30 days. You want the Google-recommended solution with the least management overhead and the least number of services. What should you do?

• A. * 1. Update your instances’ metadata to add the following value: snapshot–schedule: 0 1 * * ** 2. Update your instances’ metadata to add the following value: snapshot–retention: 30
• B. * 1. In the Cloud Console, go to the Compute Engine Disks page and select your instance’s disk.* 2. In the Snapshot Schedule section, select Create Schedule and configure the following parameters:–Schedule frequency: Daily–Start time: 1:00 AM – 2:00 AM–Autodelete snapshots after 30 days
• C. * 1. Create a Cloud Function that creates a snapshot of your instance’s disk.* 2. Create a Cloud Function that deletes snapshots that are older than 30 day
• D. 3.Use Cloud Scheduler to trigger both Cloud Functions daily at 1:00 AM.
• E. * 1. Create a bash script in the instance that copies the content of the disk to Cloud Storage.* 2. Create a bash script in the instance that deletes data older than 30 days in the backup Cloud Storage bucket.* 3. Configure the instance’s crontab to execute these scripts daily at 1:00 AM.

Answer: B

NEW QUESTION 19
......