Question 1

Which of the two actions should we take to store audit logs for long-term access using the principle of least privilege andenable maximum automation and view to external auditors?

Options :

A : Create an account for auditors to have view access to the export storage bucket with the Storage Object Viewer role

B : Export audit logs to BigQuery via an export sink

C : Export audit logs to Cloud Storage via an export sink

D : Create an account for auditors to have view access to Cloud Logging

Answer: B

Question 2

Your organization has a mission-critical application running on Google Kubernetes Engine (GKE). You have to push frequent updates to this application without causing any downtime or disrupting the user experience. As a cloud architect, which deployment strategy would you recommend?

Options :

A : Use the recreate deployment strategy for updating the application.

B : Implement a canary deployment strategy.

C : Use a blue-green deployment strategy with a manual switch.

D : Implement a rolling update strategy with readiness and liveness probes.

Answer: D

Question 3

Your operations team has asked you to help diagnose a performance issue in a production application that runs on Compute Engine. The application is dropping requests that reach it when under heavy load. The process list for affected instances shows a single application process that is consuming all available CPU, and autoscaling has reached the upper limit of instances. There is no abnormal load on any other related systems, including the database. You want to allow production traffic to be served again as quickly as possible. Which action should you recommend?

Options :

A : Change the autoscaling metric to agent.googleapis.com/memory/percent_used.

B : Restart the affected instances on a staggered schedule.

C : SSH to each instance and restart the application process.

D : Increase the maximum number of instances in the autoscaling group.

Answer: A

Question 4

An enterprise is in search of a solution for its application. The solution will handle the load in case of a failure of the entire zone. In your opinion, from the following options, which solution is better? (Choose 2)

Options :

A : Overprovision your regional managed instance group by at least 50% (for three zones)

B : Spread your managed instance group over two zones and overprovision by 100% (for two zones)

C : Do not select the "Multizone" option when creating your managed instance group

D : Create a regional unmanaged instance group and spread your instances across multiple zones

Answer: A,B

Question 5

Your organization stores sensitive customer data in Cloud Storage. You have been asked to design a solution that both prevents unauthorized data access and ensures regulatory compliance. Which of the following approaches would be the most appropriate?

Options :

A : Use Cloud Audit Logs to monitor access to Cloud Storage.

B : Use VPC Service Controls to isolate Cloud Storage.

C : Implement Cloud Identity-Aware Proxy (IAP) to control access to Cloud Storage.

D : Encrypt data using customer-managed encryption keys (CMEK) and enforce fine-grained access control with Identity and Access Management (IAM).

Answer: D