Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?

• A.Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
• B.Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
• C.Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
• D.Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.

Comment: *

Name: *

Email: *

Verification: *

You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?

• A.Security Admin privileges from the Shared VPC Admin.
• B.Service Project Admin privileges from the Shared VPC Admin.
• C.Shared VPC Admin privileges from the Organization Admin.
• D.Organization Admin privileges from the Organization Admin.

Comment: *

Name: *

Email: *

Verification: *

You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem.
What should you do?

• A.Apply an additional IAM role to the Google API's service account to allow custom mode networks.
• B.Explicitly reference the custom mode networks in the Deployment Manager templates.
• C.Explicitly reference the custom mode networks in the Cloud Armor whitelist.
• D.Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.

Comment: *

Name: *

Email: *

Verification: *

Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances.
Which two products should you incorporate into the solution? (Choose two.)

• A.VPC flow logs
• B.Firewall logs
• C.Cloud Audit logs
• D.Stackdriver Trace
• E.Compute Engine instance system logs

Comment: *

Name: *

Email: *

Verification: *

Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?

• A.Assign members of the networking team the compute.networkUser role.
• B.Assign members of the networking team the compute.networkAdmin role.
• C.Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
• D.Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.

Comment: *

Name: *

Email: *

Verification: *