Your organization has resources in two different VPCs, each in different Google Cloud projects, and requires connectivity between the resources in the two VPCs. You have already determined that there is no IP address overlap; however, one VPC uses privately used public IP (PUPI) ranges. You would like to enable connectivity between these resources by using a lower cost and higher performance method. What should you do?

• A.Create an HA VPN between the two VPCs that includes the PUPI ranges in the custom route advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
• B.Create a VPC Network Peering connection between the two VPCs that allows the export and import of custom routes for public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using service accounts as the source filter.
• C.Create a VPC Network Peering connection between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
• D.Create a VPC Network Peering connection between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using network tags as the source filter.

Comment: *

Name: *

Email: *

Verification: *

Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?

• A.Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
• B.Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
• C.Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
• D.Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.

Comment: *

Name: *

Email: *

Verification: *

Question:
You reviewed the user behavior for your main application, which uses an external global Application Load Balancer, and found that the backend servers were overloaded due to erratic spikes in client requests. You need to limit concurrent sessions and return an HTTP 429 "Too Many Requests" response back to the client while following Google-recommended practices. What should you do?

• A.Create a Cloud Armor security policy, and apply the predefined Open Worldwide Application Security Project (OWASP) rules to automatically implement the rate limit per client IP address.
• B.Configure the load balancer to accept only the defined amount of requests per client IP address, increase the backend servers to support more traffic, and redirect traffic to a different backend to burst traffic.
• C.Configure a VM with Linux, implement the rate limit through iptables, and use a firewall rule to send an HTTP 429 response to the client application.
• D.Create a Cloud Armor security policy, and associate the policy with the load balancer. Configure the security policy's settings as follows: action: throttle, conform-action: allow, exceed-action: deny-429.

Comment: *

Name: *

Email: *

Verification: *

Your company's security team tends to use managed services when possible. You need to build a dashboard to show the number of deny hits that occur against configured firewall rules without increasing operational overhead. What should you do?

• A.Configure a firewall appliance from the Google Cloud Marketplace. Route all traffic through this appliance, and apply the firewall rules at this layer. Use the firewall appliance to display the number of hits.
• B.Configure Firewall Rules Logging. Use Firewall Insights to display the number of hits.
• C.Configure Packet Mirroring on the VPC. Apply a filter with an IP address list of the Denied Firewall rules. Configure an intrusion detection system (IDS) appliance as the receiver to display the number of hits.
• D.Configure Firewall Rules Logging. View the logs in Cloud Logging, and create a custom dashboard in Cloud Monitoring to display the number of hits.

Comment: *

Name: *

Email: *

Verification: *

You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?

• A.gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
• B.gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
• C.gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
• D.gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE

Comment: *

Name: *

Email: *

Verification: *