Question:
You need to enable Private Google Access for some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on-premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team's requirements?

• A.Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
  Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
• B.Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
  Create a custom route that points Google's private API address range to the default internet gateway as the next hop.
• C.Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
  Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
• D.Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.

Comment: *

Name: *

Email: *

Verification: *

You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?

• A.Configure global load balancing to point 172.16.45.0/24 to the correct instance.
• B.Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
• C.Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0
  /24.
• D.Create unique DNS records for each service that sends traffic to the desired IP address.

Comment: *

Name: *

Email: *

Verification: *

You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)

• A.Turn on Private Google Access at the subnet level.
• B.Turn on Private Google Access at the VPC level.
• C.Turn on Private Services Access at the VPC level.
• D.Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
• E.Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.

Comment: *

Name: *

Email: *

Verification: *

You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?

• A.Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
• B.Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
• C.Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
• D.Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.

Comment: *

Name: *

Email: *

Verification: *

You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?

• A.Upload your public ssh key to the project Metadata.
• B.Upload your public ssh key to each instance Metadata.
• C.Create a custom Google Compute Engine image with your public ssh key embedded.
• D.Use gcloud compute sshto automatically copy your public ssh key to the instance.

Comment: *

Name: *

Email: *

Verification: *