You are deploying a highly confidential data processing workload on Google Cloud. Your company ' s compliance framework mandates that cryptographic keys used for encrypting data at rest must be generated and stored exclusively within a validated Hardware Security Module (HSM). You want to use a fully integrated Google Cloud managed service to handle the lifecycle and usage of these keys. What should you do?

• A. Import your on-premises HSM key material into a Cloud KMS key with the SOFTWARE protection level.
• B. Configure Cloud External Key Manager (Cloud EKM) to connect to your on-premises HSM.
• C. Use Customer-Supplied Encryption Keys (CSEK) by providing your on-premises generated key with each API request.
• D. Create a new key in Cloud Key Management Service (Cloud KMS) with the HSM protection level.

Your company has a support ticketing solution that uses App Engine Standard. The project that contains the App Engine application already has a Virtual Private Cloud(VPC) network fully connected to the company's on-premises environment through a Cloud VPN tunnel. You want to enable App Engine application to communicate with a database that is running in the company's on-premises environment. What should you do?

• A. Configure private services access
• B. Configure private Google access for on-premises hosts only
• C. Configure private Google access
• D. Configure serverless VPC access

You are responsible for the Google Cloud environment in your company Multiple departments need access to their own projects and the members within each department will have the same project responsibilities You want to structure your Google Cloud environment for minimal maintenance and maximum overview of 1AM permissions as each department ' s projects start and end You want to follow Google-recommended practices What should you do?

• A. Create a Google Group per department and add all department members to their respective groups Create a folder per department and grant the respective group the required 1AM permissions at the folder level Add the projects under the respective folders
• B. Create a folder per department and grant the respective members of the department the required 1AM permissions at the folder level. Structure all projects for each department under the respective folders
• C. Create a Google Group per department and add all department members to their respective groups Grant each group the required I AM permissions for their respective projects
• D. Grant all department members the required 1AM permissions for their respective projects

You have been engaged by your client to lead the migration of their application infrastructure to GCP. One of their current problems is that the on-premises high performance SAN is requiring frequent and expensive upgrades to keep up with the variety of workloads that are identified as follows: 20TB of log archives retained for legal reasons; 500 GB of VM boot/data volumes and templates; 500 GB of image thumbnails; 200 GB of customer session state data that allows customers to restart sessions even if off-line for several days.
Which of the following best reflects your recommendations for a cost-effective storage allocation?

• A. Memcache backed by Cloud SQL for customer session state datA. Assorted local SSD-backed instances for VM boot/data volumes. Cloud Storage for log archives and thumbnails.
• B. Memcache backed by Persistent Disk SSD storage for customer session state datA. Assorted local SSDbacked instances for VM boot/data volumes. Cloud Storage for log archives and thumbnails.
• C. Local SSD for customer session state datA. Lifecycle-managed Cloud Storage for log archives, thumbnails, and VM boot/data volumes.
• D. Memcache backed by Cloud Datastore for the customer session state datA. Lifecycle- managed Cloud Storage for log archives, thumbnails, and VM boot/data volumes.