QUESTION: 97

You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods.
What should you do?

Use Binary Authorization and whitelist only the container images used by your customers' Pods.
Use the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.
Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.
Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.

Answer(s): C

Reference:

https://cloud.google.com/kubernetes-engine/sandbox/

GKE Sandbox provides an extra layer of security to prevent untrusted code from affecting the host kernel on your cluster nodes when containers in the Pod execute unknown or untrusted code. Multi- tenant clusters and clusters whose containers run untrusted workloads are more exposed to security vulnerabilities than other clusters. Examples include SaaS providers, web-hosting providers, or other organizations that allow their users to upload and run code.
When you enable GKE Sandbox on a node pool, a sandbox is created for each Pod running on a node in that node pool. In addition, nodes running sandboxed Pods are prevented from accessing other Google Cloud services or cluster metadata. Each sandbox uses its own userspace kernel. With this in mind, you can make decisions about how to group your containers into Pods, based on the level of isolation you require and the characteristics of your applications.

https://cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods

Reveal Solution Next Question

QUESTION: 98

Your customer has implemented a solution that uses Cloud Spanner and notices some read latency- related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.

You want to resolve the issue.
What should you do?

Option A
Option B
Option C
Option D

Answer(s): C

Explanation:

As mentioned in Schema and data model, you should be careful when choosing a primary key to not accidentally create hotspots in your database. One cause of hotspots is having a column whose value monotonically increases as the first key part, because this results in all inserts occurring at the end of your key space. This pattern is undesirable because Cloud Spanner divides data among servers by key ranges, which means all your inserts will be directed at a single server that will end up doing all the work. https://cloud.google.com/spanner/docs/schema-design#primary-key-prevent-hotspots

Reveal Solution Next Question

QUESTION: 99

Your finance team wants to view the billing report for your projects. You want to make sure that the finance team does not get additional permissions to the project.
What should you do?

Add the group for the finance team to roles/billing user role.
Add the group for the finance team to roles/billing admin role.
Add the group for the finance team to roles/billing viewer role.
Add the group for the finance team to roles/billing project/Manager role.

Answer(s): C

Explanation:

"Billing Account Viewer access would usually be granted to finance teams, it provides access to spend information, but does not confer the right to link or unlink projects or otherwise manage the properties of the billing account." https://cloud.google.com/billing/docs/how-to/billing-access

Reveal Solution Next Question

QUESTION: 100

Your organization has strict requirements to control access to Google Cloud projects. You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. You want to follow Google-recommended practices.
What should you do?

Add your SREs to roles/iam.roleAdmin role.
Add your SREs to roles/accessapproval approver role.
Add your SREs to a group and then add this group to roles/iam roleAdmin role.
Add your SREs to a group and then add this group to roles/accessapproval approver role.

Answer(s): D

Reveal Solution Next Question

Free Google Associate Cloud Engineer Exam Braindumps (page: 25)

QUESTION: 97

Reference:

QUESTION: 98

Explanation:

QUESTION: 99

Explanation:

QUESTION: 100