You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the on-premises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel. Which filter should you use in Cloud Logging to examine the logs?

• A.resource.type= "vpn_gateway"
• B.resource.type= "gce_router"
• C.resource.type= "vpn_tunnel"
• D.resource.type= "gce_network_region"

Comment: *

Name: *

Email: *

Verification: *

You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?

• A.Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
• B.Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
• C.Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
• D.Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.

Comment: *

Name: *

Email: *

Verification: *

You are responsible for enabling Private Google Access for the virtual machine (VM) instances in your Virtual Private Cloud (VPC) to access Google APIs. All VM instances have only a private IP address and need to access Cloud Storage. You need to ensure that all VM traffic is routed back to your on-premises data center for traffic scrubbing via your existing Cloud Interconnect connection. However, VM traffic to Google APIs should remain in the VPC. What should you do?

• A.Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP).
  Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to Private googleapis.com, and create an A record for private.googleapis.com that resolves to the addresses in 199.36.153.8/30.
  Create a static route in your VPC for the range 199.36.153.8/30 with the default internet gateway as the next hop.
• B.Configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP) with a lower priority (MED) than the default VPC route.
  Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to private googleapis com, and create an A record for private.googleapis.com that resolves to the addresses in 199 .36.153.8/30.
  Create a static route in your VPC for the range 199.36. 153.8/30 with the default internet gateway as the next hop.
• C.Delete the default route in your VPC.
  Create a private Cloud DNS zone for googleapis.com, create a CNAME for *.googleapis.com to restricted googleapis.com, and create an A record for restricted googleapis com that resolves to the addresses in 199.36.153.4/30.
  Create a static route in your VPC for the range 199.36.153.4/30 with the default internet gateway as the next hop.
• D.Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP).
  Create a public Cloud DNS zone with a CNAME for *.google.com to private googleapis com, create a CNAME for * googleapis.com to private googleapis com, and create an A record for Private googleapis.com that resolves to the addresses in 199.36.153 8/30.
  Create a static route in your VPC for the range 199 .36.153.8/30 with the default internet gateway as the next hop.

Comment: *

Name: *

Email: *

Verification: *

You have an HA VPN connection with two tunnels running in active/passive mode between your Virtual Private Cloud (VPC) and on-premises network. Traffic over the connection has recently increased from 1 gigabit per second (Gbps) to 4 Gbps, and you notice that packets are being dropped. You need to configure your VPN connection to Google Cloud to support 4 Gbps. What should you do?

• A.Configure a second Cloud Router to scale bandwidth in and out of the VPC.
• B.Configure the remote autonomous system number (ASN) to 4096.
• C.Configure a second set of active/passive VPN tunnels.
• D.Configure the maximum transmission unit (MTU) to its highest supported value.

Comment: *

Name: *

Email: *

Verification: *

You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?

• A.Configure the authorized networks to be the subnet ranges of the other spoke projects.
• B.Enable Private Google Access on the subnet where the GKE nodes are deployed.
• C.Add a firewall rule that allows port 443 from the other spoke projects.
• D.Deploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.

Comment: *

Name: *

Email: *

Verification: *