You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?

• A.Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
• B.Manually patch some of the instances, and then perform a rolling restart on the instance group.
• C.Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
• D.Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.

Comment: *

Name: *

Email: *

Verification: *

Your company's security team tends to use managed services when possible. You need to build a dashboard to show the number of deny hits that occur against configured firewall rules without increasing operational overhead. What should you do?

• A.Configure Firewall Rules Logging. View the logs in Cloud Logging, and create a custom dashboard in Cloud Monitoring to display the number of hits.
• B.Configure Firewall Rules Logging. Use Firewall Insights to display the number of hits.
• C.Configure a firewall appliance from the Google Cloud Marketplace. Route all traffic through this appliance, and apply the firewall rules at this layer. Use the firewall appliance to display the number of hits.
• D.Configure Packet Mirroring on the VPC. Apply a filter with an IP address list of the Denied Firewall rules. Configure an intrusion detection system (IDS) appliance as the receiver to display the number of hits.

Comment: *

Name: *

Email: *

Verification: *

You have configured a Compute Engine virtual machine instance as a NAT gateway. You execute the following command:
gcloud compute routes create no-ip-internet-route \
--network custom-network1 \
--destination-range 0.0.0.0/0 \
--next-hop instance nat-gateway \
--next-hop instance-zone us-central1-a \
--tags no-ip --priority 800
You want existing instances to use the new NAT gateway. Which command should you execute?

• A.sudo sysctl -w net.ipv4.ip_forward=1
• B.gcloud compute instances add-tags [existing-instance] --tags no-ip
• C.gcloud builds submit --config=cloudbuild.waml --substitutions=TAG_NAME=no-ip
• D.gcloud compute instances create example-instance --network custom-network1 \

Comment: *

Name: *

Email: *

Verification: *

You just finished your company's migration to Google Cloud and configured an architecture with 3 Virtual Private Cloud (VPC) networks: one for Sales, one for Finance, and one for Engineering. Every VPC contains over 100 Compute Engine instances, and now developers using instances in the Sales VPC and the Finance VPC require private connectivity between each other. You need to allow communication between Sales and Finance without compromising performance or security. What should you do?

• A.Configure Cloud NAT and a Cloud Router in the Sales and Finance VPCs.
• B.Create a VPC Network Peering connection between the Finance VPC and the Sales VPC.
• C.Configure an HA VPN gateway between the Finance VPC and the Sales VPC.
• D.Configure the instances that require communication between each other with an external IP address.

Comment: *

Name: *

Email: *

Verification: *

Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API for your on-premises servers. The configuration must meet the following requirements:
Certain data must stay in the project where it is stored and not be exfiltrated to other projects.
Traffic from servers in your data center with RFC 1918 addresses do not use the internet to access Google Cloud APIs.
All DNS resolution must be done on-premises.
The solution should only provide access to APIs that are compatible with VPC Service Controls.
What should you do?

• A.Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
  Create a CNAME record for *.googleapis.com that points to the A record.
  Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
  Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
• B.Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.
  Create a CNAME record for *.googleapis.com that points to the A record.
  Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
  Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
• C.Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
  Create a CNAME record for *.googleapis.com that points to the A record.
  Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
  Configure your on-premises firewalls to allow traffic to the restricted.googleapis.com addresses.
• D.Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.
  Create a CNAME record for *.googleapis.com that points to the A record.
  Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
  Configure your on-premises firewalls to allow traffic to the private.googleapis.com addresses.

Comment: *

Name: *

Email: *

Verification: *