Your company is moving its entire workload to Compute Engine. Some servers should be accessible through the Internet, and other servers should only be accessible over the internal network. All servers need to be able to talk to each other over specific ports and protocols. The current on-premises network relies on a demilitarized zone (DMZ) for the public servers and a Local Area Network (LAN) for the private servers. You need to design the networking infrastructure on
Google Cloud to match these requirements. What should you do?

1. A. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LA
2. B. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
3. C. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LA
4. D. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
5. E. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LA
6. F. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
7. G. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LA
8. H. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.

Correct Answer: A
https://cloud.google.com/vpc/docs/vpc-peering

You need to monitor resources that are distributed over different projects in Google Cloud Platform. You want to consolidate reporting under the same Stackdriver Monitoring dashboard. What should you do?

1. A. Use Shared VPC to connect all projects, and link Stackdriver to one of the projects.
2. B. For each project, create a Stackdriver accoun
3. C. In each project, create a service account for that project and grant it the role of Stackdriver Account Editor in all other projects.
4. D. Configure a single Stackdriver account, and link all projects to the same account.
5. E. Configure a single Stackdriver account for one of the project
6. F. In Stackdriver, create a Group and add the other project names as criteria for that Group.

Correct Answer: C
When you intially click on Monitoring(Stackdriver Monitoring) it creates a workspac(a stackdriver account) linked to the ACTIVE(CURRENT) Project from which it was clicked.
Now if you change the project and again click onto Monitoring it would create an another workspace(a stackdriver account) linked to the changed ACTIVE(CURRENT) Project, we don't want this as this would not consolidate our result into a single dashboard(workspace/stackdriver account).
If you have accidently created two diff workspaces merge them under Monitoring > Settings > Merge Workspaces > MERGE.
If we have only one workspace and two projects we can simply add other GCP Project under Monitoring > Settings > GCP Projects > Add GCP Projects. https://cloud.google.com/monitoring/settings/multiple-projects
Nothing about groups https://cloud.google.com/monitoring/settings?hl=en

Your organization has strict requirements to control access to Google Cloud projects. You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. You want to follow Google-recommended practices. What should you do?

1. A. Add your SREs to roles/iam.roleAdmin role.
2. B. Add your SREs to roles/accessapproval approver role.
3. C. Add your SREs to a group and then add this group to roles/iam roleAdmin role.
4. D. Add your SREs to a group and then add this group to roles/accessapproval approver role.

Correct Answer: D

You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use?

1. A. HTTPS Load Balancer
2. B. Network Load Balancer
3. C. SSL Proxy Load Balancer
4. D. Internal TCP/UDP Load Balance
5. E. Add a firewall rule allowing ingress traffic from 0.0.0.0/0 on the target instances.

Correct Answer: C

You need to grant access for three users so that they can view and edit table data on a Cloud Spanner instance. What should you do?

1. A. Run gcloud iam roles describe roles/spanner.databaseUse
2. B. Add the users to the role.
3. C. Run gcloud iam roles describe roles/spanner.databaseUse
4. D. Add the users to a new grou
5. E. Add the group to the role.
6. F. Run gcloud iam roles describe roles/spanner.viewer --project my-projec
7. G. Add the users to the role.
8. H. Run gcloud iam roles describe roles/spanner.viewer --project my-projec
9. I. Add the users to a new group.Add the group to the role.

Correct Answer: B
https://cloud.google.com/spanner/docs/iam#spanner.databaseUser
Using the gcloud tool, execute the gcloud iam roles describe roles/spanner.databaseUser command on Cloud Shell. Attach the users to a newly created Google group and add the group to the role.