Option 1 is the correct answer. cron.yaml is a file for setting a scheduled task (cron job) that operates at a specified time or at regular intervals. It is necessary to modify cron.yaml in order to modify the periodic processing such as batch jobs.

Option 2 is incorrect. A file called config.yaml does not exist as a configuration file for App Engine.

Option 3 is incorrect. The file setting.yaml does not exist as a configuration file for App Engine.

Option 4 is incorrect. app.yaml is a file that describes settings related to the application, the entire network, and the programming language runtime. This time it doesn't matter.

【reference】 https://cloud.google.com/appengine/docs/flexible/java/configuring-datastore-indexes-with-index-yaml#index_definitions

Option 3 is the correct answer. Managed instance groups allow multiple application operations on the same VM. This is best used when creating a redundant configuration that can withstand zone failures. Managed instance groups provide features such as auto-scaling, auto-repair, multi-zone deployment, and auto-update for scalable and highly available workload processing.

Option 1 is incorrect. Unmanaged instance groups are a good place to load balance a group of heterogeneous instances, or if you need to manage your own instances. Therefore, it is easier to set up this requirement by using a managed instance group.

Option 2 is incorrect. Instance templates are templates that you can use to create virtual machine instances and managed instance groups, and are not relevant here.

Option 4 is incorrect. Resource groups are a feature in Cloud Monitoring to define a set of resources as a group and are not relevant here.

【reference】 https://cloud.google.com/compute/docs/instance-groups/

Option 1 is the correct answer. If an error occurs because access control between resources is not possible, access is denied by the policy. Therefore, it is necessary to check the status of policy denials and to check the policy denial audit log. The policy denial audit log is recorded when the Google Cloud service denies access to a user or service account due to a policy violation.

Option 2 is incorrect. The data access audit log is irrelevant this time because it records API calls to read resource configurations and metadata, as well as user-driven API calls to create, modify, and read user-supplied resource data.

Option 3 is incorrect. This time it is irrelevant because the management activity log records events related to API calls and other management actions that change the resource's configuration or metadata.

Option 4 is incorrect. There is no audit log named ID Access Audit Log.

【reference】 https://cloud.google.com/logging/docs/audit

Option 4 is the correct answer. You can get the metadata of an object by running the command `gsutil stat gs: // [bucket name] / [object name]`.

Option 1 is incorrect. Running gsutil version will print the version of the gsutil tool.

Option 2 is incorrect. gsutil list is not a valid command.

Option 3 is incorrect. gsutil describe is not a valid command.

【reference】 https://cloud.google.com/storage/docs/gsutil/commands/stat

Option 3 is the correct answer. roles / logging.privateLogViewer grants read permission to all logs, including access transparency logs and data access audit logs. Only the roles / logging.privateLogsViewer should be set because the auditor only needs to be granted read permission.

Option 1 is incorrect. There is no role called roles / logging.privateLogReader.

Option 2 is incorrect. Since roles / logging.admin grants full permissions to Logging, it grants more permissions than required. This is an inappropriate setting that violates the principle of least privilege.

Option 4 is incorrect. roles / logging.admin.privateLogViewer does not grant read permission for data access audit logs, which is an inappropriate setting.

【reference】 https://cloud.google.com/logging/docs/access-control

Option 1 is the correct answer. You can get the Windows Server image list by executing the command `gcloud compute images list --project [image project name] --no-standard-images` with windows-cloud specified in [image project name]. increase.

Options 2 and 4 are incorrect. `gcloud compute images describe` Used to get detailed information about a single image.

Option 3 is incorrect. gcloud compute images list --project = = windows-cloud --project, not --no-standard-images Enter the project name by opening half-width characters like windows-cloud.

【reference】 https://cloud.google.com/sdk/gcloud/reference/compute/images/list

Option 2 is the correct answer. By executing the command gcloud projects add-iam-policy-binding test1 --member = [member name] --role = [role name] `, you can specify a specific project and set a role for the member. You can grant specific permissions.

Option 1 is incorrect. The command for 'user: [email protected]'add'roles / editor' is incorrect. By executing --member = [member name] --role = [role name] `, you can specify a specific project, set a role for a member, and grant specific privileges.

Option 3 is incorrect. There is no subcommand called set-iam-policy-binding.

Option 4 is incorrect. The subcommand --project = test1 does not exist. Gcloud projects add-iam-policy-binding Enter [project name] to specify the project.

【reference】 https://cloud.google.com/sdk/gcloud/reference/projects/add-iam-policy-binding

Option 4 is the correct answer. You can specify and connect to a specific database by running the command `gcloud sql connect [instance name] --user = [database user name]`.

Option 1 is incorrect. The --root parameter does not exist.

Options 2 and 3 are incorrect. The `gsutil` command is used to operate Cloud Storage and is not relevant here.

【reference】 https://cloud.google.com/sdk/gcloud/reference/sql/connect

Option 2 is the correct answer. Queries are billed based on the number of bytes read, so specify the --dry_run flag of the bg command to get the estimated number of bytes to be read and estimate the price based on this number of bytes.

Option 1 is incorrect. The --cost flag does not exist in bg command

Option 3 is incorrect. The dryRun parameter does not exist in bg command

Option 4 is incorrect. The cost parameter does not exist in bg command

【reference】 https://cloud.google.com/bigquery/docs/best-practices-costs#bq

Option 2 is the correct answer. You can quickly change the Cloud SDK (gcloud command) settings by running the command `gcloud config configurations activate [configuration name]`. This makes it easy to switch between working clients.

Option 1 is incorrect. The `gcloud auth` command is for authenticating your Google Cloud account and is not relevant here.

Options 3 and 4 are incorrect. Roles are permissions to Google Cloud resources that you can't use to change Cloud SDK (gcloud command) settings.

【reference】 https://cloud.google.com/sdk/gcloud/reference/config