Your company has an application that is running on multiple instances of Compute Engine. It generates 1 TB per day of logs. For compliance reasons, the logs need to be kept for at least two years. The logs need to be available for active query for 30 days. After that, they just need to be retained for audit purposes. You want to implement a storage solution that is compliant, minimizes costs, and follows Google-recommended practices. What should you do?
Answer(s): A
Option A is the most appropriate solution due to its effective use of Google Cloud's managed services and cost optimization strategies. Firstly, installing the Cloud Logging agent on each Compute Engine instance (step 1) is the recommended practice for collecting application logs. These agents automatically forward logs to Cloud Logging, eliminating the need for custom log management scripts. Secondly, creating a sink to export these logs to a regional Cloud Storage bucket (step 2) allows for centralized, cost-effective storage of the logs. Cloud Storage is designed for high availability and durability. Thirdly, utilizing Object Lifecycle Management (step 3) to move logs to a Coldline Storage bucket after 30 days addresses the cost aspect of long-term storage. Coldline Storage is significantly cheaper than standard storage, suitable for infrequently accessed data like older logs. Finally, configuring a retention policy at the bucket level with bucket lock (step 4) fulfills the compliance requirement of retaining logs for at least two years and prevents accidental deletion of the data.Option B is suboptimal because it involves manually managing logs with a cron job. This increases operational overhead and potential for errors compared to the automated approach offered by Cloud Logging. Options C and D store the data into BigQuery, which is not cost-optimal when the primary requirement after 30 days is just to retain logs for audit and not for analysis. Option C does not offer any method to adhere to the required two-year retention and option D involves running cron jobs on all instances which is not an ideal approach compared to using Cloud Logging agents.Therefore, option A achieves the requirements of compliance, cost-effectiveness, and adherence to Google-recommended practices.Authoritative Links:Cloud Logging Agent: https://cloud.google.com/logging/docs/agent Cloud Storage Sinks: https://cloud.google.com/logging/docs/export/configure_sinks Cloud Storage Object Lifecycle Management: https://cloud.google.com/storage/docs/lifecycle Cloud Storage Retention Policies: https://cloud.google.com/storage/docs/bucket-lock Cloud Storage Storage Classes: https://cloud.google.com/storage/docs/storage-classes
Your company has just recently activated Cloud Identity to manage users. The Google Cloud Organization has been configured as well. The security team needs to secure projects that will be part of the Organization. They want to prohibit IAM users outside the domain from gaining permissions from now on. What should they do?
Option A, configuring an organization policy to restrict identities by domain, is the most effective and appropriate solution. Organization policies provide centralized control and governance over your Google Cloud resources. Specifically, the "constraints/iam.allowedPolicyMemberDomains" constraint allows you to specify which domains are permitted to be granted IAM roles within the organization. By setting this policy, you can directly prohibit users from outside your Cloud Identity domain from being added to projects, preventing unauthorized access right from the point of configuration. This approach is proactive, automated, and doesn't rely on reactive scripts or scheduled jobs. It aligns with the principle of least privilege and provides consistent enforcement across the entire organization. Option B, blocking service account creation, is not the required action since the question was specifically about user identities, not service accounts. Option C and D, while technically feasible, are cumbersome and reactive rather than preventative. They would incur more operational overhead, be less secure, and are less scalable. Moreover, scripts could encounter race conditions if users are being added and removed simultaneously. Choosing a policy-based solution leverages the inherent capabilities of Google Cloud for centralized access control, ensuring compliance and enhancing security. Organization policies are the recommended way to manage access control at scale.Further research:Organization policy constraints Using constraints Understanding organization policies
Your company has an application running on Google Cloud that is collecting data from thousands of physical devices that are globally distributed. Data is published to Pub/Sub and streamed in real time into an SSD Cloud Bigtable cluster via a Dataflow pipeline. The operations team informs you that your Cloud Bigtable cluster has a hotspot, and queries are taking longer than expected. You need to resolve the problem and prevent it from happening in the future. What should you do?
Answer(s): C
The correct answer is C. Review your RowKey strategy and ensure that keys are evenly spread across the alphabet.Here's why: Hotspots in Cloud Bigtable typically arise when writes are concentrated on a small set of rows or regions. This happens when row keys are not properly distributed. In this scenario, the data coming from thousands of globally distributed physical devices might be using sequential or time-based row keys, causing all writes to gravitate towards the same region of the Bigtable cluster. Consequently, this specific region becomes overloaded, leading to performance bottlenecks, i.e., a hotspot.Option C directly addresses the root cause of hotspots by recommending a review of the row key strategy. Ensuring that keys are evenly distributed across the alphabet (or any other large and diverse character set),effectively spreads the writes and reads across different regions in Bigtable, preventing a single region from becoming overloaded and thus resolving the hotspot issue. Using a well-distributed row key strategy is fundamental for optimal performance with Bigtable.Option A (using HBase APIs) is irrelevant, as the problem is not API-related but rather data layout. Option B (deleting old records) can help with storage space but does not address the hotspot caused by poor row key design. Option D (doubling nodes) might temporarily alleviate the problem but doesn't fix the underlying issue of uneven data distribution; it’s an expensive band-aid, not a long-term solution. Row key optimization is crucial for efficient data processing within a distributed system such as Bigtable.For further reading:Cloud Bigtable Schema Design: https://cloud.google.com/bigtable/docs/schema-design Key Visualizer: https://cloud.google.com/bigtable/docs/key-visualizer Avoiding Hotspots: https://cloud.google.com/bigtable/docs/avoiding-hotspots
Your company has a Google Cloud project that uses BigQuery for data warehousing. There are some tables that contain personally identifiable information (PII). Only the compliance team may access the PII. The other information in the tables must be available to the data science team. You want to minimize cost and the time it takes to assign appropriate access to the tables. What should you do?
Option C is the most appropriate solution because it effectively addresses the requirements of separating access to PII while minimizing cost and management overhead. Here's a breakdown:1. Creating a separate dataset for the data science team (Step 1) ensures clear segregation of resources and simplifies access control management. It allows you to grant specific permissions at the dataset level without impacting other data assets. 2. Creating views (Step 2) rather than materialized views is crucial for cost minimization. Views are logical representations of data, not physical copies. They don't incur storage costs and always reflect the latest data in the base tables. 3. Excluding PII in the views ensures that data scientists only access the information relevant to their work, maintaining compliance with data privacy regulations. 4. Assigning an appropriate project-level IAM role (Step 3) gives the data science team the necessary access to the project as a whole. This enables them to use BigQuery and query the views. 5. Assigning access controls to the view dataset (Step 4) isolates the access to those views only to the members of the data science team and nobody else, this ensures clear access boundaries. 6. Authorizing the view to access the source dataset (Step 5) is essential because the view, which resides in a different dataset, needs permission to read data from the source dataset containing PII. BigQuery views do not inherit permissions from source tables and datasets.Options A and B don’t segregate access to data, meaning there could be cross access by members of the data science team. Option D is not recommended because materialized views are physical copies of data, incurring storage costs, maintenance overheads and possible data staleness when updates to the underlying source table occur. The choice of views keeps costs and effort to a minimum.Relevant Cloud Computing Concepts:Principle of Least Privilege: Option C follows this principle by granting only the necessary access to each team. The data science team does not require access to PII; therefore, they should be limited to data views with no PII included. IAM (Identity and Access Management): IAM allows fine-grained control of access to GCP resources based on roles and permissions. This is central to managing access and security in BigQuery. Data Governance: Separating access to PII is a core aspect of data governance. Views help to enforce data governance policies by creating a controlled view of the underlying data. Cost Optimization: Views incur little cost compared to materialized views as they do not require storage space.Authoritative Links:BigQuery views : Explanation of how BigQuery views function. BigQuery authorized views : Explanation of how to authorize a view to access a different dataset. BigQuery IAM roles : Overview of IAM roles and permissions for BigQuery. Principle of Least Privilege : Google Cloud's approach to least privilege.
Your operations team currently stores 10 TB of data in an object storage service from a third-party provider. They want to move this data to a Cloud Storage bucket as quickly as possible, following Google-recommended practices. They want to minimize the cost of this data migration. Which approach should they use?
Answer(s): B
The optimal approach is to use Storage Transfer Service (STS). Here's why: STS is a fully managed, serverless service designed specifically for large-scale data transfers into and out of Google Cloud Storage. Unlike gsutil mv , which is primarily intended for file management within Cloud Storage, STS is optimized for transferring data from various sources, including third-party object storage. STS offers features like automated retry logic, scheduling, and bandwidth throttling, ensuring a reliable and efficient migration. Downloading to a Transfer Appliance (option C) or an on-premises data center (option D) adds unnecessary steps, increasing complexity, time, and cost. While a Transfer Appliance is suitable for extremely large datasets or situations with limited network connectivity, 10TB doesn't warrant its use, introducing delays and expenses.Downloading to an on-premises location (option D) is also inefficient as it requires intermediate storage and upload processes. Given the scale of 10TB and the requirement for minimizing cost, STS provides a cost-effective and streamlined approach. It leverages Google’s network infrastructure to deliver high-performance transfers, and users only pay for the actual data transferred. It also allows for efficient management of the entire process via its web console or API. STS minimizes operational overhead and offers a more secure path for migrating data compared to manual approaches.Authoritative Link: Storage Transfer Service Overview
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.