You need to configure a Google Kubernetes Engine (GKE) cluster. The initial deployment should have 5 nodes with the potential to scale to 10 nodes. The maximum number of Pods per node is 8. The number of services could grow from 100 to up to 1024. How should you design the IP schema to optimally meet this requirement?

1. A. Configure a /28 primary IP address range for the node IP addresse
2. B. Configure a (25 secondary IP range for the Pod
3. C. Configure a /22 secondary IP range for the Services.
4. D. Configure a /28 primary IP address range for the node IP addresse
5. E. Configure a /25 secondary IP range for the Pod
6. F. Configure a /21 secondary IP range for the Services.
7. G. Configure a /28 primary IP address range for the node IP addresse
8. H. Configure a /28 secondary IP range for the Pod
9. I. Configure a /21 secondary IP range for the Services.
10. J. Configure a /28 primary IP address range for the node IP addresse
11. K. Configure a /24 secondary IP range for the Pad
12. L. Configure a /22 secondary IP range for the Services.

Correct Answer: A

Your organization's security policy requires that all internet-bound traffic return to your on-premises data center through HA VPN tunnels before egressing to the internet, while allowing virtual machines (VMs) to leverage private Google APIs using private virtual IP addresses 199.36.153.4/30. You need to configure the routes to enable these traffic flows. What should you do?

1. A. Configure a custom route 0.0.0.0/0 with a priority of 500 whose next hop is the default internet gateway.Configure another custom route 199.36.153.4/30 with priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.
2. B. Configure a custom route 0.0.0.0/0 with a priority of 1000 whose next hop is the internet gateway.Configure another custom route 199.36.153.4/30 with a priority of 500 whose next hop is the VPN tunnel back to the on-premises data center.
3. C. Announce a 0.0.0.0/0 route from your on-premises router with a MED of 1000. Configure a custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the default internet gateway.
4. D. Announce a 0.0.0.0/0 route from your on-premises router with a MED of 500. Configure another custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the VPN tunnel back to the onpremises data center.

Correct Answer: A

You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?

1. A. Enable Data Access audit logs of the VP
2. B. Analyze the logs and get the source IP addresses from the subnetworks.get field.
3. C. Enable VPC Flow Logs for the subne
4. D. Analyze the logs and get the source IP addresses from the connection field.
5. E. Enable VPC Flow Logs for the VP
6. F. Analyze the logs and get the source IP addresses from the src_location field.
7. G. Enable Data Access audit logs of the subne
8. H. Analyze the logs and get the source IP addresses from the networks.get field.

Correct Answer: B

You are configuring load balancing for a standard three-tier (web, application, and database) application. You have configured an external HTTP(S) load balancer for the web servers. You need to configure load balancing for the application tier of servers. What should you do?

1. A. Configure a forwarding rule on the existing load balancer for the application tier.
2. B. Configure equal cost multi-path routing on the application servers.
3. C. Configure a new internal HTTP(S) load balancer for the application tier.
4. D. Configure a URL map on the existing load balancer to route traffic to the application tier.

Correct Answer: A

You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)

1. A. Turn on Private Google Access at the subnet level.
2. B. Turn on Private Google Access at the VPC level.
3. C. Turn on Private Services Access at the VPC level.
4. D. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
5. E. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.

Correct Answer: AD
https://cloud.google.com/vpc/docs/private-access-options#pga Private Google Access VM instances that only have internal IP addresses (no external IP addresses) can use Private Google Access. They can reach the_external IP addresses_ of Google APIs and services.