Your organization is using Google Cloud to develop and host its applications. Following Google- recommended practices, the team has created dedicated projects for development and production. Your development team is located in Canada and Germany. The operations team works exclusively from Germany to adhere to local laws. You need to ensure that admin access to Google Cloud APIs is restricted to these countries and environments. What should you do?

• A. Create dedicated IAM Groups for the Canadian and German developers. Grant access to the development and production projects according to the requirements.
• B. Create dedicated firewall policies for each environment at the organization level, and then apply these policies to the projects. Create a rule to restrict access based on geolocations.
• C. Group all development and production projects in separate folders. Activate the organization policy on the folders to restrict resource location according to the requirements.
• D. Create dedicated VPC Service Controls perimeters for development and production projects. Configure distinct ingress policies to allow access from the respective countries.

You are responsible for managing identities in your company's Google Cloud organization. Employees are frequently using your organization's corporate domain name to create unmanaged Google accounts. You want to implement a practical and efficient solution to prevent employees from completing this action in the future.
What should you do?

• A. Register a new domain for your Google Cloud resources. Move all existing identities and resources to this domain.
• B. Switch your corporate email system to another domain to avoid using the same domain for Google Cloud identities and corporate emails.
• C. Implement an automated process that scans all identities in your organization and disables any unmanaged accounts.
• D. Create a Google Cloud identity for all users in your organization. Ensure that new users are added automatically.

Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can run in the environment. What should you do?

• A. Use Kubernetes role-based access control (RBAC) as the source of truth for cluster access by granting
  "container clusters.get" to limited users. Restrict deployment access by allowing these users to generate a kubeconfig file containing the configuration access to the GKE cluster.
• B. Enforce the use of Cloud Code for development so users receive real-time security feedback on vulnerable libraries and dependencies before they check in their code.
• C. Enable Binary Authorization and create attestations of scans.
• D. Use gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID
  /REPOSITORY/IMAGE_ID@sha256:HASH --show-package-vulnerability in your CI/CD pipeline, and trigger a pipeline failure for critical vulnerabilities.

Your organization is using Google Workspace, Google Cloud, and a third-party SIEM. You need to export events such as user logins, successful logins, and failed logins to the SIEM. Logs need to be ingested in real time or near real-time. What should you do?

• A. Poll Cloud Logging for authentication events using the gcloud logging read tool.3 Forward the events to the SIEM.
• B. Configure Google Workspace to directly send logs to the API endpoint of the third-party SIEM.4
• C. Create a Cloud Logging sink to export relevant authentication logs to a Pub/Sub topic for SIEM subscription.
• D. Create a Cloud Storage bucket as a sink for all logs. Configure the SIEM to periodically scan the bucket for new log files.

What is the best course of action regarding data privacy and model tuning when using Vertex AI?

• A. Do nothing. Vertex AI foundation models are frozen by default and do not use your data for model- tuning purposes.
• B. Encrypt your data by using customer-managed encryption keys (CMEK) to have full control over encryption key access.
• C. Contact Google support to opt out of model tuning.
• D. Do not use Vertex AI for sensitive data. Use only public data with minimal privacy requirements.