You successfully provisioned a single Dedicated Interconnect. The physical connection is at a colocation facility closest to us-west2. Seventy-five percent of your workloads are in us-east4, and the remaining twenty-five percent of your workloads are in us-central1. All workloads have the same network traffic profile. You need to minimize data transfer costs when deploying VLAN attachments. What should you do?

1. A. Keep the existing Dedicated interconnec
2. B. Deploy a VLAN attachment to a Cloud Router in us-west2, and use VPC global routing to access workloads in us-east4 and us-central1.
3. C. Keep the existing Dedicated Interconnec
4. D. Deploy a VLAN attachment to a Cloud Router in us-east4, and deploy another VLAN attachment to a Cloud Router in us-central1.
5. E. Order a new Dedicated Interconnect for a colocation facility closest to us-east4, and use VPC globalrouting to access workloads in us-central1.
6. F. Order a new Dedicated Interconnect for a colocation facility closest to us-central1, and use VPC global routing to access workloads in us-east4.

Correct Answer: C

In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost:
Port 8080 should always be open for VMs in the projects in the Dev folder.
Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder. What should you do?

1. A. Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
2. B. Create a Shared VPC for the Dev projects and a Shared VPC for the Prod project
3. C. Create a VPC firewall rule to open port 8080 in the Shared VPC for De
4. D. Create a firewall rule to deny traffic to port 8080 in the Shared VPC for Pro
5. E. Deploy VMs to those Shared VPCs.
6. F. In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
7. G. Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.

Correct Answer: A

You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?

1. A. Configure VPC peering in a full mesh.
2. B. Alter the routing table to resolve the asymmetric route.
3. C. Create network tags to allow connectivity between all three VPCs.
4. D. Delete the legacy network and recreate it to allow transitive peering.

Correct Answer: A
https://cloud.google.com/vpc/docs/using-vpc-peering

You are the Organization Admin for your company. One of your engineers is responsible for setting up multiple host projects across multiple folders and sharing subnets with service projects. You need to enable the engineer's Identity and Access Management (IAM) configuration to complete their task in the fewest number of steps. What should you do?

1. A. Set up the engineer with Compute Shared VPC Admin IAM role at the folder level.
2. B. Set up the engineer with Compute Shared VPC Admin IAM role at the organization level.
3. C. Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the folder level.
4. D. Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the organization level.

Correct Answer: B

You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?

1. A. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Service
2. B. Create a VPC-native cluster and specify those ranges.
3. C. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Service
4. D. Create a VPC-native cluster and specify those range
5. E. When the services are ready to be deployed, resize the subnets.
6. F. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
7. G. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.

Correct Answer: A
The service range setting is permanent and cannot be changed. Please see
https://stackoverflow.com/questions/60957040/how-to-increase-the-service-address-range-of-a-gke-cluster I think the correc tanswer is A since: Grow is expected to up to 100 nodes (that would be /25), then up to 200 pods per node (100 times 200 = 20000 so /17 is 32768), then 1500 services in a /21 (up to 2048)
https://docs.netgate.com/pfsense/en/latest/book/network/understanding-cidr-subnet-mask-notation.html