Answer: C
Option A is incorrect because VPC Service Controls is used isolate resources of multi-tenant Google Cloud services to mitigate data exfiltration risks.
Option B is incorrect because this is a security management and data risk platform that helps with security vulnerabilities and threats.
Option C is correct because Cloud Audit Logs is designed to provide visibility into who did what, when, and where for all user activity on GCP and integrates into other popular SIEM partners.
Option D is incorrect because Access Transparency gives you near real-time logs when Google Cloud administrators access your content.
See https://cloud.google.com/vpc-service-controls for more information
See https://cloud.google.com/security-command-center for more information on Security Command centre.
See https://cloud.google.com/audit-logs for more information on Audit logs.
See https://cloud.google.com/access-transparency for more information on Access Transparency

Answer: C
Option A is incorrect because it doesn’t follow the principle of least privilege using predefined roles usually gives more permissions than is needed. Although using google groups to manage members and Folders for departments (which could have multiple projects) is effective and scalable
Option B is incorrect because it doesn’t follow the principle of least privilege using predefined roles usually gives more permissions than is needed. Also using individual google accounts is cumbersome to manage and does not scale well.
Option C is correct using google groups to manage members and Folders for departments (which could have multiple projects) is effective and scalable. Also using custom IAM roles follows the principle of least privilege.
Option D is incorrect because using individual google accounts is cumbersome to manage and does not scale well.
See https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy for more information on Resource Hierarchy

Answer: C
Option A is incorrect because the Internal HTTP(S) load balancer is not external facing and does not support IPv6 or custom origin and it is regional.
Option B is incorrect because it does not support content-based routing or custom origin as a backend service even though it is a global load balancer.
Option C is correct because it meets all the specified requirements
Option D is incorrect because it does not support content-based routing or custom origin as a backend service and it is a regional load balancer.
See https://cloud.google.com/load-balancing/docs/choosing-load-balancer for more information on GCP load balancers.

Answer: D
Option A is incorrect because the Internal HTTP(S) load balancer is not external facing and it is regional.
Option B is incorrect because it does not preserve source IP and it has SSL offload even though it is a global load balancer.
Option C is incorrect because it does not preserve source IP and it has SSL offload even though it is a global load balancer
Option D is correct because it meets all the specified requirements and it is a regional load balancer.
See https://cloud.google.com/load-balancing/docs/choosing-load-balancer for more information on GCP load balancers.

Answer: B
Option A is incorrect
Option B is correct because without the appropriate firewall rules to allow the health checks, GCP load balancer classifies your instances as unhealthy
Option C is incorrect
Option D is incorrect
See https://cloud.google.com/load-balancing/docs/health-check-concepts#ip-ranges for more information on health checks for GCP load balancers.

Answer: D
Option A is incorrect, although GKE uses instances, they are managed on your behalf.
Option B is incorrect, this used with managed services like App Engine and Cloud Run
Option C is incorrect, this is for static images or applications deployed to cloud storage
Option D is correct, this is how GKE exposes applications running on its cluster externally.
See https://cloud.google.com/cdn/docs/using-cdn for more information on Cloud CDN.

Answer: B
Option A is incorrect
Option B is correct, this is the only load balancer that can be paired with Cloud CDN
Option C is incorrect
Option D is incorrect because Cloud Armor is used for defense against DoS and web attacks.
See https://cloud.google.com/cdn/docs/best-practices for more information on Cloud CDN.

Answer: C
Option A is incorrect because it does not offer flexibility in IP addressing or naming subnets
Option B is incorrect, this is an auto mode network
Option C is correct, custom mode networks allows the flexibility of choosing a CIDR block and unique names for the subnets
Option D is incorrect.
See https://cloud.google.com/solutions/best-practices-vpc-design#custom-mode for more information on custom mode networks.

Answer: B
Options A and C are incorrect because they are just types of VPC that can be created in GCP.
Option B is correct, this is the only way to ensure that control for all networking resources (in a host project) are centralized and easy to manage. Service project departments can configure and manage non-network resources, enabling a clear separation of responsibilities for different teams in the organization.
Option D is incorrect because it is used to connect multiple VPCs together..
See https://cloud.google.com/solutions/best-practices-vpc-design#shared-vpc for more information on Shared VPC

Answer: D
Options A, B and C are incorrect because they are not the smallest CIDR to give a maximum of 200 hosts and do not meet the criteria of choosing the smallest CIDR block.
Option D is correct, this is the smallest CIDR block that gives 251 useable addresses thereby suitable for a 200 host subnet design.

Answer: C
Option A is incorrect because stopping and restarting an instance doesn’t change the internal IP address neither does it change an ephemeral IP to a static one.
Option B is incorrect as this is disruptive to the availability of the application.
Option C is correct, this is the least disruptive action to achieve the task.
Option D is incorrect. This action is impossible
See https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address to understand more on reserving IP addresses.

Answer: A & B
Options A & B are correct because they provide access to Google APIs with external IPs, for GCE instances with no external IPs in GCP subnets.
Option C is incorrect as this is used to access services like Cloud SQL which have private IPs
Option D is incorrect, this is used for on-premises to access google APIs.
See https://cloud.google.com/vpc/docs/private-access-options to understand the variety of google APIs access for private instances.

Answer: D
Options A & B are incorrect because Cloud Interconnect is the more expensive options and has a slower speed of deployment.
Option C is incorrect as this is use to peer multiple GCP VPCs.
Option D is correct, Cloud VPN is cheapest and fastest option for hybrid connectivity to GCP. Cloud Router is used for enabling dynamic routing via BGP.
See https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview to understand more on Cloud VPN and how to set it up.

Correct Option:

• A. Direct Peering: This is correct because Direct Peering allows for direct access from your on-premises network to Google’s edge network, which includes G Suite and Google APIs. It also has no associated setup or maintenance costs and can reduce internet egress rates for traffic within the same continent.

Incorrect Options:

• B. Partner Interconnect: This is incorrect because Partner Interconnect involves using a service provider to connect to Google Cloud, which may have associated costs and does not necessarily connect directly to Google’s edge network.
• C. Carrier Peering: This is incorrect because Carrier Peering also involves using a third-party carrier for connectivity, which may have associated costs and does not provide direct access to Google’s edge network.
• D. Dedicated Interconnect: This is incorrect because Dedicated Interconnect provides a direct physical connection to Google Cloud, but it involves setup and maintenance costs, and it does not specifically address reduced internet egress rates

Answer: B
Option A is incorrect because it is not a managed service, the firm still has to manage the availability of the instances.
Option B is the right answer, this is GCPs managed DNS service with 100% SLA
Option C is incorrect because this is used for hybrid connectivity.
Option D is incorrect because this is used to connect the on-premises to G Suite.
https://cloud.google.com/dns provides more overview and in-depth documentation on the capabilities of Cloud DNS.

Answer: A
Option A is correct because the higher priority route with take precedence if there is more than one route to a destination IP and the correct next hop for VPN is the VPN tunnel.
Option B are incorrect because the correct next hop for VPN is the VPN tunnel not IP Address.
Option C is the incorrect because the requirement is to have two routes. Also if two routes have the same priority, traffic will be load-balanced across them that is not Active Passive.
Option D is incorrect because the correct next hop for VPN connection is the VPN tunnel not IP, also if two routes have the same priority, traffic will be load-balanced across them that is not Active Passive.
https://cloud.google.com/network-connectivity/docs/vpn/concepts/order-of-routes provides more in-depth documentation on the order with which GCP handles custom routes.

Answer: C
Option A and B are incorrect because they are not used in connecting GCP to on-premises networks.
Option C is the right answer, this is used in conjunction with Cloud VPN or Cloud Interconnect, depending on the requirements, to provide BGP dynamic routing between GCP and the on- premises network
Option D is incorrect because this is used to connect the on-premises to G Suite.
https://cloud.google.com/network-connectivity/docs/router provides more overview and in-depth documentation on the capabilities of Cloud Router.

Answer: B and C
Option A is incorrect because it is stated that firewall rules have been tested and work fine.
Option B and C is the right answer, assigning tags to the instances used by the developers and creating a new custom route for internet-bound traffic with a higher priority and a next hop as the instance with the appliance installed.

Option D is incorrect because this is used for hybrid connectivity.

Answer: B
Option A is incorrect, you cannot assigning CIDR range at the VPC level in GCP.
Option D is incorrect, this is used to create public IPs.
Option B and C is the right answer, you can add a secondary CIDR range at the subnet level and in the GKE Cluster under Networking.

See https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips for more information on the Alias IP ranges for GKE clusters.

Answer: B and C
Option A and D are incorrect because number of subnets or VPCs does not affect the number of interfaces that can be attached to a GCE instance.
Option B and C are correct because the machine type (f1-micro, n1-standard etc.) and the number of vCPUs affects the maximum number of interfaces a GCE instance can have.
See:
https://cloud.google.com/vpc/docs/create-use-multiple-interfaces#max-interfaces for more information on instances with multiple interfaces

Answer: A
Option A is correct, because Shared VPC is created in the host project and that is where the appliance, to be shared, should also be created. Subnets are shared with Service Projects. Option B is incorrect the network appliance should be created in the host project.
Option C is incorrect because it fails to satisfy the requirement of sharing a network appliance.
Option D is incorrect because you can not create a Shared VPC in a Service project.
See https://cloud.google.com/vpc/docs/multiple-interfaces-concepts for more information on using multiple NICs

Answer: A
Option A is correct Cloud NAT needs a Cloud Router in the same region.
Option B, C & D are incorrect, there is no need to create a custom route, or External IP or VPC peering for Clout NAT.
https://cloud.google.com/nat/docs/overview has more information on the Cloud NAT service.

Answer: C
The maximum pod per is 110. Therefore for 8 nodes = 880 pods (IP addresses). A /22 has 1024 addresses and is the minimum needed for the pod IP CIDR. A /28 has 16 addresses (for a maximum of 12 nodes) is the minimum needed for a cluster of 8 nodes, also a /21 CIDR has 2048 addresses is the minimum needed for the Services IP CIDR.
Option A is incorrect because subnet size is too large with 128 addresses, pod IP is also large with 4096 addresses and services IP cidr with 8192 addresses.
Option B is incorrect because subnet size is too large with 64 addresses, pod IP is also large with 2048 addresses and services IP cidr with 4096 addresses
Option C is correct
Option D is incorrect because subnet size is large with 32 addresses, pod IP is too small with 512 addresses and services IP cidr with 1024 addresses
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips provides more insight into creating a VPC-native GKE cluster.

Answer: C & D
Option A is incorrect because Cloud Audit logs gives visibility into user actions on GCP who did what, when and where.
Option B is incorrect because this provides information on the traffic to and from the load balancer
Option C is correct because this shows traffic (allowed or denied) that has matched a firewall rule
Option D is correct because this captures samples of the traffic flowing in and out of the subnet.
See https://cloud.google.com/vpc/docs/firewall-rules-logging for more on firewall logs
See https://cloud.google.com/vpc/docs/flow-logs for more on VPC flow logs

Answer: D
Option A, B & C are incorrect because none of them has the permissions to create a shared vpc.
Option D is correct because it has the permissions to create a shared vpc.
See https://cloud.google.com/iam/docs/understanding-roles#compute-engine-roles to see the permissions in the compute engine roles.
See https://cloud.google.com/vpc/docs/provisioning-shared-vpc for more on creating shared VPC.

Answer: C
Options A, B are incorrect because they give more permissions than is required. It does not follow the principle of least privilege.
Option C is correct because it has just the permissions to manage the interconnect.
Option D is incorrect because roles/compute.networkUser is a predefined role and has excessive permission for the tasks specified.
See https://cloud.google.com/iam/docs/understanding-roles#compute-engine-roles to see the permissions in the compute engine roles.

Answer: A & B
Options A & B are correct, you need to enable DNSSEC on your Cloud DNS zone and also at your domain registrar.
Options C & D are incorrect because there have nothing to do with DNSSEC.
https://cloud.google.com/dns/docs/dnssec for more on DNSSEC.

Answer: B & D
Options A is incorrect, firewalls do not affect the creation of VPC peering.
Option B and D are correct, you need certain permissions to be able to create VPC peering and also the subnets in the VPCs cannot have overlapping CIDRs.
Options C is incorrect, GCP VPCs are global by default.
https://cloud.google.com/vpc/docs/vpc-peering explains the properties and restrictions of creating VPC peering.

Answer: D
Options A and C is incorrect, what is needed is an ingress rule.
Option B is incorrect, you need the firewall rule should be for specified target tags i.e. webserver.
Options D is correct, it is an ingress rule for the specified tags and firewall logs is turned on.
https://cloud.google.com/vpc/docs/firewall-rules-logging explains more on firewall logging

Answer: A
Option A is correct, this is how to restrict pod communications in GKE
Option B is incorrect, ingress is used to expose services externally via a HTTPS Load balancing.
Option C is incorrect, Enable master authorized networks is used to block untrusted non- GCP source IPs from accessing the Kubernetes master through HTTPS
Options D is incorrect, this does not apply to inter-pods communications
https://kubernetes.io/docs/concepts/services-networking/network-policies/ and https://cloud.google.com/kubernetes-engine/docs/how-to/network-policy explains Network Policies more.

Answer: C
Options A is incorrect, this minimum bandwidth for dedicated interconnect is 10Gbps
Option B is incorrect, the firm will have to manage their BGP sessions if this is chosen
Option C is correct, this option means the service provider manages the BGP session with your Cloud Router.
Options D is incorrect, this does not connect GCP Networks to on-premises network
https://cloud.google.com/network-connectivity/docs/interconnect/how-to/partner/provisioning-overview explains cloud interconnect provisioning.

Answer: A
Options A is correct.
Option B is incorrect, because not enabling the Pre-activate the VLAN attachments means the firm will manage the BGP sessions which isn’t the requirement.
Option C is incorrect, because this option is for the configuration on a VLAN for direct interconnect.
Options D is incorrect, because the cloud router must be in the same region as the interconnect connection.
https://cloud.google.com/network-connectivity/docs/interconnect/how-to/partner/provisioning- overview explains cloud interconnect provisioning.

Answer: D
Options A is incorrect because the default dynamic routing mode is regional, this means only the subnet in the Cloud Router region will be advertised also there is no need for a static route to be created, the Cloud Router will add dynamic routes.
Option B is incorrect, because Cloud VPN tunnel has a max performance of 3Gbps which does not meet the bandwidth requirement.
Option C is incorrect, because the default dynamic routing mode is regional, this means only the subnet in the Cloud Router region will be advertised. A Cloud router is needed to dynamically learn routes to and from the GCP
Options D is correct, because Global routing mode is needed, a Cloud Router and Cloud VPN with two tunnels to meet the bandwidth requirement.
https://cloud.google.com/network-connectivity/docs/router/concepts/overview explains Dynamic routing mode.
https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview#vpn-types explains how to choose VPN types
The diagram below shows the default Dynamic routing mode is Regional

Answer: B
Options A is incorrect, RDP allows remote users to see and use Windows on a device in another location.
Option B is correct, BGP is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS), i.e. GCP and your on- premises network, on the Internet.
Option C is incorrect, because Secure Shell, is a remote administration protocol that allows users to control and modify their remote servers over the Internet
Options D is incorrect, because RFC1918 describes a set of network IP ranges set aside for so-called “private” use.

Answer: A
Options A is correct, The Network load balancer is a pass-through type of load balancer and the default Session Affinity ensures that traffic (different sessions) is distributed evenly across the backend.
Option B is incorrect, all sessions from the same client to reach the same backend, as long as the backend stays healthy. In general, it will provide for better session affinity than the default method, but the overall traffic may not be as evenly distributed.
Option C and D is incorrect, because SSL Proxy load balancer cannot be used for pass- through traffic. It proxies all traffic.
See https://cloud.google.com/load-balancing/docs/target-pools#sessionaffinity for more explanation of Session Affinity option in GCP.
See https://cloud.google.com/load-balancing/docs/choosing-load-balancer for more on how to choose a load balancer in GCP.

Answer C
Options A, B & D are incorrect, ports 25 and 110 are not possible destination ports for HTTP(S) Load balancers.
Option C is correct, ports 80, 8080 & 443 are the destination ports for the HTTP(S) load balancer.
https://cloud.google.com/load-balancing/docs/choosing-load-balancer provides a list of the destination ports for the different load balancers.

Answer: A
Options A is correct, see diagram below. The most efficient place to set a Network Service
Tier is at the Project-wide level, else it will have to be set in every resources deployed.
B & D are incorrect, this cannot be set at an organization (root) level but at the Project level.
Option C is incorrect, Network Service Tiers is under Networking.
https://cloud.google.com/network-tiers/docs/overview explains the different services and the Network service tiers used.

Answer: B and D
Option A is incorrect because there are default routes create when subnets are created to allow inter-subnet communications.
Option B and D are correct, Custom VPCs have no firewall rules created and Private Google Access is turned off by default.
Option C is incorrect, VPC Flow logs is turned off by default

Answer: A, B and D
Option A is correct, the Compute Network Admin can list the firewall rules.
Option B is correct, the Compute Network Admin cannot create of delete firewall rules
Option C is incorrect, the Compute Network Admin cannot enable of disable a Shared VPC.
Option D is correct, the Compute Network Admin can create and delete interconnect attachments.
https://cloud.google.com/compute/docs/access/iam#compute.networkAdmin has a list of the permissions for the Compute Network Admin.

Answer: D
Option A is incorrect, it does not have the needed permissions.
Option B is incorrect, it the needed permission and a lot more permissions than is needed
Option C is incorrect, it does not have all the permissions needed.
Option D is correct, this has the right amount of permissions needed for the group to carry out its duties. It follows the principle of least privilege.
https://cloud.google.com/compute/docs/access/iam#compute.networkAdmin has a list of the permissions for the Compute Network Admin.
https://cloud.google.com/compute/docs/access/iam#compute.networkUser has a list of the permissions for the Compute Network User.
https://cloud.google.com/compute/docs/access/iam#compute.securityAdmin has a list of the permissions for the Compute Security Admin.

Answer: A & C
Option A is correct, service accounts use Key-pairs to authenticate to Google.
Option B is incorrect, they do not have passwords
Option C is correct, permissions can be granted to allow users to impersonate a service account.
Option D is incorrect, they can be disabled and deleted.
https://cloud.google.com/iam/docs/service-accounts has more details on service accounts.

Answer: D
Option A is incorrect, this is the total number of addresses in the CIDR range.
Option B is incorrect, GCP reserves four IP addresses in every primary CIDR range
Option C is incorrect, GCP reserves four IP addresses in every primary CIDR range.
Option D is correct, GCP reserves four IP addresses in every primary CIDR range therefore you are left with 251 usable addresses.
https://cloud.google.com/vpc/docs/vpc#reserved_ip_addresses_in_every_subnet explains the IP reservations in Subnets.

Answer: C
Option A is incorrect, firewall rules are at VPC level also we are told the firewall rules are ok.
Option B is incorrect, one subnet can raise the internet so the routes is not the problem. Also route are VPC wide not subnet specific.
Option C is correct, private GCE instances need Cloud NAT to reach the internet.
Option D is incorrect, Cloud Router is used to dynamically exchange route information between two networks.

Answer: A & C
Option A is correct this shows VMs that initiates a connection that is successfully allocated to a NAT IP and port and traverses to the internet.
Option B is incorrect, this is not an option for Cloud NAT logging.
Option C is correct, it shows details of when the NAT gateway can’t allocate a NAT IP and port due to port exhaustion.
Option D is incorrect, this is not an option for Cloud NAT logging.

Answer: A
Option A is correct this satisfies all of the requirements.
Option B is incorrect, this is not an option in GKE network mode. Option C is incorrect this is not an option in GKE network mode. Option D is incorrect, it does not satisfy any of the other requirements.
https://cloud.google.com/kubernetes-engine/docs/how-to/routes-based-cluster and
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips#cluster_sizing explain the differences in the two cluster network modes

Answer: B
Option A is incorrect because it doesn’t follow the principle of least privilege. The compute engine default service account has a primitive role of editor which is too permissive.
Option B is correct because it uses a custom role with permissions for selected services and it uses the Secret manager service to securely store the database password and encrypt it at rest using cloud KMS.
Option C is incorrect because hardcoding database password into the application is not best practice and using the compute engine default service account is too permissive.
Option D is incorrect because it is not possible to use IAM to store credentials.
See https://cloud.google.com/iam/docs/overview for more information on IAM Roles
See https://cloud.google.com/kms/docs/iam to understand how IAM is integrated with Cloud KMS
See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets for more information on Secret Manager.

Answer: C
Option A and B is incorrect because you cannot add or remove network interfaces from an existing VM.
Option C is correct because adding more network interfaces can only be done at creation of instances
Option D is incorrect because IP forwarding is done at the VM level.
See https://cloud.google.com/vpc/docs/create-use-multiple-interfaces#max-interfaces for more information on instances with multiple interfaces.

Answer: C
Options A is incorrect, it is a managed compute platform that enables you to run stateless containers that are invocable via web requests or Pub/Sub events.
Option B is incorrect, it is a lightweight compute solution for developers to create single- purpose, stand-alone functions that respond to Cloud events without the need to manage a server or runtime environment.
Option C is correct, it allows you to specify all the resources needed for your application in a declarative format using yaml.
Option D is incorrect, this does not allow for automating repeatability.
https://cloud.google.com/deployment-manager provides more information on the features and usability of deployment manager.

Answer: D
Option A is incorrect this does not satisfy any of the requirements.
Option B is incorrect, this is not an option in GKE network mode.
Option C is incorrect this is not an option in GKE network mode.
Option D is correct, this allows for flexibility in pod per node configuration and all the other requirements.
https://cloud.google.com/kubernetes-engine/docs/how-to/routes-based-cluster and
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips#cluster_sizing explain the differences in the two cluster network modes

Answer: B
Option A is incorrect.
Option B is correct, Cloud VPN uses IPSec for encryption.
Option C is incorrect.
Option D is incorrect.
https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview#specifications highlights the specifications for Cloud VPN

Correct Options:

• B. There is no firewall rule to allow incoming ICMP traffic from the on-premises network: This is correct because firewall rules control the flow of traffic to and from your GCE instances. If there is no firewall rule explicitly allowing ICMP (ping) traffic from the on-premises network to the GCE instance, the traffic will be denied by default.
• D. There is no route in GCP to the on-premises network: This is correct because routes define the paths that network traffic takes. If there is no route in GCP that directs traffic from the GCE instance to the on-premises network, the ping requests won’t be able to reach the GCE instance or return to the on-premises network.

Incorrect Options:

• A. A Cloud Armor security policy is denying the traffic: This is incorrect because Cloud Armor primarily provides security policies for HTTP(S) traffic, and it does not manage ICMP traffic. Therefore, it is unlikely that a Cloud Armor policy is the cause of the ping failure.
• C. The implied allow egress rule which permits outgoing ICMP traffic from your GCP network has been overridden: This is incorrect because even if the implied allow egress rule was overridden, it would affect outgoing traffic from GCP, not incoming ICMP traffic from the on-premises network. The issue here is related to incoming traffic, so this option does not apply.

Answer: B & D
Option A is incorrect, DNS peering is used to send records requests from one VPC to another VPC.
Option C is incorrect, it is inbound forwarding that is used to allow DNS queries from on- premises into GCP.
Option B & D is correct, if the Cloud VPN has no connectivity the DNS queries into GCP would fail.
https://cloud.google.com/dns/docs/troubleshooting provides a checklist for troubleshooting Cloud DNS