QUESTION: 109

Your organization has user identities in Active Directory. Your organization wants to use Active Directory as their source of truth for identities. Your organization wants to have full control over the Google accounts used by employees for all Google services, including your Google Cloud Platform (GCP) organization.
What should you do?

Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
Use the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
Export users from Active Directory as a CSV and import them to Cloud Identity via the Admin Console.
Ask each employee to create a Google account using self signup. Require that each employee use their company email address and password.

Answer(s): A

Reference:

https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction

Directory Sync Google Cloud Directory Sync enables administrators to synchronize users, groups and other data from an Active Directory/LDAP service to their Google Cloud domain directory https://tools.google.com/dlpage/dirsync/

Reveal Solution Next Question

QUESTION: 110

You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now, you need to create a production environment for this application.

The security team has forbidden the existence of network routes between these 2 environments, and asks you to follow Google-recommended practices.
What should you do?

Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.
Create a new production subnet in the existing VPC and a new production Cloud SQL instance in your existing project, and deploy your application using those resources.
Create a new project, modify your existing VPC to be a Shared VPC, share that VPC with your new project, and replicate the setup you have in the development environment in that new project, in the Shared VP
Ask the security team to grant you the Project Editor role in an existing production project used by another division of your company. Once they grant you that role, replicate the setup you have in the development environment in that project.

Answer(s): A

Explanation:

This aligns with Googles recommended practices. By creating a new project, we achieve complete isolation between development and production environments; as well as isolate this production application from production applications of other departments.

Reference:

https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#define- hierarchy

Reveal Solution Next Question

QUESTION: 111

Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project.
What should you do?

Ask the auditor for their Google account, and give them the Viewer role on the project.
Ask the auditor for their Google account, and give them the Security Reviewer role on the project.
Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.

Answer(s): C

Explanation:

Using primitive roles The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ. IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions. https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles https://cloud.google.com/iam/docs/understanding-custom-roles

Reveal Solution Next Question

QUESTION: 112

You have a workload running on Compute Engine that is critical to your business. You want to ensure that the data on the boot disk of this workload is backed up regularly. You need to be able to restore a backup as quickly as possible in case of disaster. You also want older backups to be cleaned automatically to save on cost. You want to follow Google-recommended practices.
What should you do?

Create a Cloud Function to create an instance template.
Create a snapshot schedule for the disk using the desired interval.
Create a cron job to create a new disk from the disk using gcloud.
Create a Cloud Task to create an image and export it to Cloud Storage.

Answer(s): B

Explanation:

Best practices for persistent disk snapshots

You can create persistent disk snapshots at any time, but you can create snapshots more quickly and with greater reliability if you use the following best practices.

Creating frequent snapshots efficiently

Use snapshots to manage your data efficiently.

Create a snapshot of your data on a regular schedule to minimize data loss due to unexpected failure.

Improve performance by eliminating excessive snapshot downloads and by creating an image and reusing it.

Set your snapshot schedule to off-peak hours to reduce snapshot time.

Snapshot frequency limits

Creating snapshots from persistent disks

You can snapshot your disks at most once every 10 minutes. If you want to issue a burst of requests to snapshot your disks, you can issue at most 6 requests in 60 minutes.

If the limit is exceeded, the operation fails and returns the following error:

https://cloud.google.com/compute/docs/disks/snapshot-best-practices

Reveal Solution Next Question

Free Google Associate Cloud Engineer Exam Braindumps (page: 28)

QUESTION: 109

Reference:

QUESTION: 110

Explanation:

Reference:

QUESTION: 111

Explanation:

QUESTION: 112

Explanation: