As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.
Which cost reduction options should you recommend?

• A. Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
• B. Use FindingLimits and TimespanContfig to sample data and minimize transformation units.
• C. Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
• D. Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.

You need to centralize your team's logs for production projects. You want your team to be able to search and analyze the logs using Logs Explorer. What should you do?

• A. Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.
• B. Use Logs Explorer at the organization level and filter for production project logs.
• C. Enable Cloud Monitoring workspace, and add the production projects to be monitored.
• D. Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?

• A. 1. In BigQuery, select the related dataset.2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.
• B. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.2.Click on the email address in line with the App Engine Default Service Account in the authentication field.3.Click Hide Matching Entries.4.
  Make sure the resulting list is empty.
• C. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.2.Click on the email address in line with the App Engine Default Service Account in the authentication field.3.Click Show Matching Entries.4.
  Make sure the resulting list is empty.
• D. 1. Go to the IAM section on the project.2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.

You have noticed an increased number of phishing attacks across your enterprise user accounts. You want to implement the Google 2-Step Verification (2SV) option that uses a cryptographic signature to authenticate a user and verify the URL of the login page. Which Google 2SV option should you use?

• A. Titan Security Keys
• B. Cloud HSM keys
• C. Google prompt
• D. Google Authenticator app

A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?

• A. Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.
• B. Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).
• C. Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.
• D. Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.