Your organization has resources in two different VPCs, each in different Google Cloud projects, and requires connectivity between the resources in the two VPCs. You have already determined that there is no IP address overlap; however, one VPC uses privately used public IP (PUPI) ranges. You would like to enable connectivity between these resources by using a lower cost and higher performance method. What should you do?

• A.Create an HA VPN between the two VPCs that includes the PUPI ranges in the custom route advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
• B.Create a VPC Network Peering connection between the two VPCs that allows the export and import of custom routes for public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using service accounts as the source filter.
• C.Create a VPC Network Peering connection between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
• D.Create a VPC Network Peering connection between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using network tags as the source filter.

Comment: *

Name: *

Email: *

Verification: *

You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload.
Which type of load balancer should you use?

• A.HTTP(S) load balancer
• B.Network load balancer
• C.Internal load balancer
• D.TCP/SSL proxy load balancer

Comment: *

Name: *

Email: *

Verification: *

You have the following routing design. You discover that Compute Engine instances in Subnet-2 in the asia- southeast1 region cannot communicate with compute resources on-premises. What should you do?

• A.Enable IP forwarding in the asia-southeast1 region.
• B.Add a second Border Gateway Protocol (BGP) session to the Cloud Router.
• C.Configure a custom route advertisement on the Cloud Router.
• D.Change the VPC dynamic routing mode to Global.

Comment: *

Name: *

Email: *

Verification: *

Question:
Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute instances that run these applications have an associated secure tag. What should you do?

• A.Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.
• B.Deploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
• C.Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
• D.Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.

Comment: *

Name: *

Email: *

Verification: *

Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it as a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost.
Which two steps should you take? (Choose two.)

• A.Use Cloud Armor to blacklist the attacker's IP addresses.
• B.Create a global HTTP(s) load balancer and move your application backend to this load balancer.
• C.Increase the maximum autoscaling backend to accommodate the severe bursty traffic.
• D.Shut down the entire application in GCP for a few hours. The attack will stop when the application is offline.
• E.SSH into the backend compute engine instances, and view the auth logs and syslogs to further understand the nature of the attack.

Comment: *

Name: *

Email: *

Verification: *