You are configuring the firewall endpoints as part of the Cloud Next Generation Firewall (Cloud NGFW) intrusion prevention service in Google Cloud. You have configured a threat prevention security profile, and you now need to create an endpoint for traffic inspection. What should you do?

• A.Attach the profile to the VPC network, create a firewall endpoint within the zone, and use a firewall policy rule to apply the L7 inspection.
• B.Create a firewall endpoint within the zone, associate the endpoint to the VPC network, and use a firewall policy rule to apply the L7 inspection.
• C.Create a firewall endpoint within the region, associate the endpoint to the VPC network, and use a firewall policy rule to apply the L7 inspection.
• D.Create a Private Service Connect endpoint within the zone, associate the endpoint to the VPC network, and use a firewall policy rule to apply the L7 inspection.

Comment: *

Name: *

Email: *

Verification: *

You want to configure a NAT to perform address translation between your on-premises network blocks and GCP.
Which NAT solution should you use?

• A.An instance with IP forwarding enabled
• B.An instance configured with iptables DNAT rules
• C.An instance configured with iptables SNAT rules
• D.Cloud NAT

Comment: *

Name: *

Email: *

Verification: *

Question:
Your organization has distributed geographic applications with significant data volumes. You need to create a design that exposes the HTTPS workloads globally and keeps traffic costs to a minimum. What should you do?

• A.Deploy a regional external Application Load Balancer with Standard Network Service Tier.
• B.Deploy a regional external Application Load Balancer with Premium Network Service Tier.
• C.Deploy a global external proxy Network Load Balancer with Standard Network Service Tier.
• D.Deploy a global external Application Load Balancer with Premium Network Service Tier.

Comment: *

Name: *

Email: *

Verification: *

You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
- Flow logs are enabled for the VPC subnet, and all firewall rules are
set to log.
- The subnetwork logs are not excluded from Stackdriver.
- The instance that is hosting the application can communicate outside
the subnet.
- Other instances within the subnet can communicate outside the subnet.
- The external resource initiates communication.
What is the most likely cause of the missing log lines?

• A.The traffic is matching the expected ingress rule.
• B.The traffic is matching the expected egress rule.
• C.The traffic is not matching the expected egress rule.
• D.The traffic is not matching the expected ingress rule.

Comment: *

Name: *

Email: *

Verification: *

You are the network administrator responsible for hybrid connectivity at your organization. Your developer team wants to use Cloud SQL in the us-west1 region in your Shared VPC. You configured a Dedicated Interconnect connection and a Cloud Router in us-west1, and the connectivity between your Shared VPC and on-premises data center is working as expected. You just created the private services access connection required for Cloud SQL using the reserved IP address range and default settings. However, your developers cannot access the Cloud SQL instance from on-premises. You want to resolve the issue. What should you do?

• A.Create an additional Cloud Router in us-west2.
  Create a new Border Gateway Protocol (BGP) peering connection to your on-premises data center.
  Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.
• B.Change the VPC routing mode to global.
  Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.
• C.Change the VPC routing mode to global.
  Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.
• D.Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.
  Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.

Comment: *

Name: *

Email: *

Verification: *