Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?
A.
Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.
B.
Ask each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.
C.
Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the ג€compute.osAdminLoginג€ role to the Google group corresponding to this team.
D.
Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.
You have a development project with appropriate IAM roles defined. You are creating a production project and want to have the same IAM roles on the new project, using the fewest possible steps. What should you do?
A.
Use gcloud iam roles copy and specify the production project as the destination project.
B.
Use gcloud iam roles copy and specify your organization as the destination organization.
C.
In the Google Cloud Platform Console, use the 'create role from role' functionality.
D.
In the Google Cloud Platform Console, use the 'create role' functionality and select all applicable permissions.
Your organization has strict requirements to control access to Google Cloud projects. You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. You want to follow Google-recommended practices. What should you do?
A.
Add your SREs to roles/iam.roleAdmin role.
B.
Add your SREs to roles/accessapproval.approver role.
C.
Add your SREs to a group and then add this group to roles/iam.roleAdmin.role.
D.
Add your SREs to a group and then add this group to roles/accessapproval.approver role.
You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on that application. Which feature should you use?
A.
Use a Shielded VM.
B.
Use a Preemptible VM.
C.
Use a sole-tenant node.
D.
Enable deletion protection on the instance.
Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?
A.
Add users to roles/bigquery user role only, instead of roles/bigquery dataOwner.
B.
Add users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.
C.
Create a custom role by removing delete permissions, and add users to that role only.
D.
Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.