Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization.
What should you do?

• A. Implement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection.
• B. No action is necessary because Google encrypts data while it is in use by default.
• C. Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances.
• D. Implement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection.

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project. How should you make an exception for your partner's domain while following the stated best practices?

• A. Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.
• B. Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service.
• C. Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."
• D. Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.

A website design company recently migrated all customer sites to App Engine. Some sites are still in progress and should only be visible to customers and company employees from any location.
Which solution will restrict access to the in-progress sites?

• A. Upload an .htaccess file containing the customer and employee user accounts to App Engine.
• B. Create an App Engine firewall rule that allows access from the customer and employee networks and denies all other traffic.
• C. Enable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.
• D. Use Cloud VPN to create a VPN connection between the relevant on-premises networks and the company's GCP Virtual Private Cloud (VPC) network.

A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?

• A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
• B. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
• C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than
  1000.
• D. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.

Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?

• A. * 1, Publish the software code on GitHub as open source.* 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
• B. * 1. Hire an external auditor to review and provide provenance* 2. Define the scope and conditions.* 3.Get support from the Security department or representative.* 4. Publish the attestation to your public web page.
• C. * 1. Review the software process.* 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact.* 3. Publish the PGP signed attestation to your public web page.
• D. * 1- Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build.* 2. View the build provenance in the Security insights side panel within the Google Cloud console.