You have several microservices running in a private subnet in an existing Virtual Private Cloud (VPC). You need to create additional serverless services that use Cloud Run and Cloud Functions to access the
microservices. The network traffic volume between your serverless services and private microservices is low. However, each serverless service must be able to communicate with any of your microservices. You want to implement a solution that minimizes cost. What should you do?

1. A. Deploy your serverless services to the serverless VP
2. B. Peer the serverless service VPC to the existing VP
3. C. Configure firewall rules to allow traffic between the serverless services and your existing microservices.
4. D. Create a serverless VPC access connector for each serverless servic
5. E. Configure the connectors to allow traffic between the serverless services and your existing microservices.
6. F. Deploy your serverless services to the existing VP
7. G. Configure firewall rules to allow traffic between the serverless services and your existing microservices.
8. H. Create a serverless VPC access connecto
9. I. Configure the serverless service to use the connector for communication to the microservices.

Correct Answer: D

You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?

1. A. Grant the compute.instanceAdmin to your user account.
2. B. Grant the iam.serviceAccountUser to your user account.
3. C. Grant the read-only privilege to the service account for the Cloud Storage bucket.
4. D. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.

Correct Answer: C

You are designing a new application that has backends internally exposed on port 800. The application will be exposed externally using both IPv4 and IPv6 via TCP on port 700. You want to ensure high availability for this application. What should you do?

1. A. Create a network load balancer that used backend services containing one instance group with two instances.
2. B. Create a network load balancer that uses a target pool backend with two instances.
3. C. Create a TCP proxy that uses a zonal network endpoint group containing one instance.
4. D. Create a TCP proxy that uses backend services containing an instance group with two instances.

Correct Answer: D

Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API for your on-premises servers. The configuration must meet the following requirements:
Certain data must stay in the project where it is stored and not be exfiltrated to other projects.
Traffic from servers in your data center with RFC 1918 addresses do not use the internet to access Google Cloud APIs.
All DNS resolution must be done on-premises.
The solution should only provide access to APIs that are compatible with VPC Service Controls. What should you do?

1. A. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.Create a CNAME record for *.googleapis.com that points to the A record.Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
2. B. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.Create a CNAME record for *.googleapis.com that points to the A record.Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.Configure your on-premises firewalls to allow traffic to the restricted.googleapis.com addresses.
3. C. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.Create a CNAME record for *.googleapis.com that points to the A record.Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
4. D. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.Create a CNAME record for *.googleapis.com that points to the A record.Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.Configure your on-premises firewalls to allow traffic to the private.googleapis.com addresses.

Correct Answer: C

You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem.
What should you do?

1. A. Apply an additional IAM role to the Google API’s service account to allow custom mode networks.
2. B. Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
3. C. Explicitly reference the custom mode networks in the Cloud Armor whitelist.
4. D. Explicitly reference the custom mode networks in the Deployment Manager templates.

Correct Answer: D