You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem.
What should you do?

• A.Explicitly reference the custom mode networks in the Cloud Armor whitelist.
• B.Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
• C.Explicitly reference the custom mode networks in the Deployment Manager templates.
• D.Apply an additional IAM role to the Google API's service account to allow custom mode networks.

Comment: *

Name: *

Email: *

Verification: *

You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)

• A.Turn on Private Google Access at the subnet level.
• B.Turn on Private Google Access at the VPC level.
• C.Turn on Private Services Access at the VPC level.
• D.Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
• E.Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.

Comment: *

Name: *

Email: *

Verification: *

You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?

• A.Create the Distribution VPC in auto mode.
  Peer both the VPCs via network peering.
• B.Create the Distribution VPC in custom mode.
  Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
• C.Create the Distribution VPC in custom mode.
  Use the CIDR range 10.128.0.0/9.
  Create the necessary subnets, and then peer them via network peering.
• D.Rename the default VPC as "Distribution" and peer it via network peering.

Comment: *

Name: *

Email: *

Verification: *

You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even though the cluster is up and running.
What should you do to solve the problem?

• A.Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.
• B.Create the appropriate master authorized network entries to allow the instance to communicate to the master.
• C.Create a route to reach the Master, pointing to the default internet gateway.
• D.Assign a public IP address to the instance.

Comment: *

Name: *

Email: *

Verification: *

You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules.
Always allow Secure Shell (SSH) from your corporate IP address.
Restrict SSH access from all other IP addresses.
There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team's requirements. What should you do?

• A.Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0.
  Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1.
• B.Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0.
  Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1.
• C.Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1.
  Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0.
• D.Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1 Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.

Comment: *

Name: *

Email: *

Verification: *