A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?

1. A. BigQuery datasets
2. B. Cloud Storage buckets
3. C. StackDriver logging
4. D. Cloud Pub/Sub topics

Correct Answer: C

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?

1. A. * 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.* 2. Click on the email address in line with the App Engine Default Service Account in the authentication field.* 3. Click Hide Matching Entrie
2. B. * 4. Make sure the resulting list is empty.
3. C. * 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.* 2. Click on the email address in line with the App Engine Default Service Account in the authentication field.* 3. Click Show Matching Entrie
4. D. * 4. Make sure the resulting list is empty.
5. E. * 1. In BigQuery, select the related dataset.* 2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.
6. F. * 1. Go to the IAM section on the project.* 2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.

Correct Answer: C

Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?

1. A. Compute Network User Role at the host project level.
2. B. Compute Network User Role at the subnet level.
3. C. Compute Shared VPC Admin Role at the host project level.
4. D. Compute Shared VPC Admin Role at the service project level.

Correct Answer: C

A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?

1. A. VPC Flow Logs
2. B. Cloud Armor
3. C. DNS Security Extensions
4. D. Cloud Identity-Aware Proxy

Correct Answer: C

What are the steps to encrypt data using envelope encryption?

1. A. Generate a data encryption key (DEK) locally.Use a key encryption key (KEK) to wrap the DE
2. B. Encrypt data with the KE
3. C. Store the encrypted data and the wrapped KEK.
4. D. Generate a key encryption key (KEK) locally.Use the KEK to generate a data encryption key (DEK). Encrypt data with the DE
5. E. Store the encrypted data and the wrapped DEK.
6. F. Generate a data encryption key (DEK) locally.Encrypt data with the DEK.Use a key encryption key (KEK) to wrap the DE
7. G. Store the encrypted data and the wrapped DEK.
8. H. Generate a key encryption key (KEK) locally.Generate a data encryption key (DEK) locall
9. I. Encrypt data with the KE
10. J. Store the encrypted data and the wrapped DEK.

Correct Answer: C