You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?

• A.GKE Ingress
• B.GKE Node
• C.GKE Pod
• D.GKE Cluster

Comment: *

Name: *

Email: *

Verification: *

Your company has launched a mobile application that uploads pictures to google cloud storage bucket. The application was successfully uploading the pictures to google cloud storage buckets, but lately the application has become popular and you start seeing 429 errors. Please suggest the ways to address the issue. Please select any two.

• A.Throttle your client's requests
• B.Use truncated exponential backoff
• C.The OAuth access token has expired and needs to be refreshed.
• D.Use the correct verb with the /upload or /download URLs.

Comment: *

Name: *

Email: *

Verification: *

You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC-native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses.
Which subnet mask should you use for the Pod IP address range?

• A./21
• B./22
• C./23
• D./25

Comment: *

Name: *

Email: *

Verification: *

In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subnet- a. You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers. What should you do?

• A.Create service accounts [email protected] and [email protected]. Associate the service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:
  gcloud compute firewall-rules create app-db-firewall-ru
  --allow TCP:3306 \
  --source-ranges 10.128.0.0/20 \
  --source-service-accounts sa-app@my-
  project.iam.gserviceaccount.com \
  --target-service-accounts sa-db@my-
  project.iam.gserviceaccount.com
• B.Create network tag app-server and service account [email protected]. Add the tag to the application servers, and associate the service account with the database servers. Run the following command:
  gcloud compute firewall-rules create app-db-firewall-rule \
  --action allow \
  --direction ingress \
  --rules top:3306 \
  --source-tags app-server \
  --target-service-accounts sa-db@my-
  project.iam.gserviceaccount.com
• C.Create service accounts [email protected] and [email protected]. Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:
  gcloud compute firewall-rules create app-db-firewall-ru
  --allow TCP:3306 \
  --source-service-accounts sa-app@democloud-idp-
  demo.iam.gserviceaccount.com \
  --target-service-accounts sa-db@my-
  project.iam.gserviceaccount.com
• D.Create network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers. Run the following command:
  gcloud compute firewall-rules create app-db-firewall-rule \
  --action allow \
  --direction ingress \
  --rules tcp:3306 \
  --source-ranges 10.128.0.0/20 \
  --source-tags app-server \
  --target-tags db-server

Comment: *

Name: *

Email: *

Verification: *

You work for a multinational enterprise that is moving to GCP.
These are the cloud requirements:
* An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup)
* Multiple regional offices in Europe and APAC
* Regional data processing is required in europe-west1 and australia-southeast1
* Centralized Network Administration Team
Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us-west1.
What should you do?

• A.* Create 2 VPCs in a Shared VPC Host Project.
  * Configure a 2-NIC instance in zone us-west1-a in the Service Project.
  * Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
  * Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.
  * Deploy the instance.
  * Configure the necessary routes and firewall rules to pass traffic through the instance.
• B.* Create 2 VPCs in a Shared VPC Host Project.
  * Configure a 2-NIC instance in zone us-west1-a in the Host Project.
  * Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
  * Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.
  * Deploy the instance.
  * Configure the necessary routes and firewall rules to pass traffic through the instance.
• C.* Create 1 VPC in a Shared VPC Service Project.
  * Configure a 2-NIC instance in zone us-west1-a in the Service Project.
  * Attach NIC0 in us-west1 subnet of the Service Project.
  * Attach NIC1 in us-west1 subnet of the Service Project
  * Deploy the instance.
  * Configure the necessary routes and firewall rules to pass traffic through the instance.
• D.* Create 1 VPC in a Shared VPC Host Project.
  * Configure a 2-NIC instance in zone us-west1-a in the Host Project.
  * Attach NIC0 in us-west1 subnet of the Host Project.
  * Attach NIC1 in us-west1 subnet of the Host Project
  * Deploy the instance.
  * Configure the necessary routes and firewall rules to pass traffic through the instance.

Comment: *

Name: *

Email: *

Verification: *