Question 1

You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?

Options :

A :

1. Use nslookup to get the IP address for storage.googleapis.com.2. Negotiate with the security team to be able to give a public IP address to the servers.3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.

B :

1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud Platform (GCP).2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance.3. Configure your servers to use that instance as a proxy to access Cloud Storage.

C :

1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine.2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend.3. Configure your new instances to use this ILB as proxy.

D :

1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP.2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.

Answer: D

Question 2

You are developing a new application and are looking for a Jenkins installation to build and deploy your source code. You want to automate the installation as quickly and easily as possible. What should you do?

Options :

A : Deploy Jenkins through the Google Cloud Marketplace.

B : Create a new Compute Engine instance. Run the Jenkins executable.

C : Create a new Kubernetes Engine cluster. Create a deployment for the Jenkins image.

D :

Create an instance template with the Jenkins executable. Create a managed instance group with this template.

Answer: A

Question 3

You have an object in a Cloud Storage bucket that you want to share with an external company. The object

contains sensitive data. You want access to the content to be removed after four hours. The external company

does not have a Google account to which you can grant specific user-based access privileges. You want to use

the most secure method that requires the fewest steps. What should you do?

Options :

A : Create a signed URL with a four-hour expiration and share the URL with the company.

B : Set object access to ‘public’ and use object lifecycle management to remove the object after four hours.

C :

Configure the storage bucket as a static website and furnish the object’s URL to the company. Delete the object from the storage bucket after four hours.

D :

Create a new Cloud Storage bucket specifically for the external company to access. Copy the object to that bucket. Delete the bucket after four hours have passed.

Answer: A

Question 4

You deployed an LDAP server on Compute Engine that is reachable via TLS through port 636 using UDP.

You want to make sure it is reachable by clients over that port. What should you do?

Options :

A : Add the network tag allow-udp-636 to the VM instance running the LDAP server.

B :

Create a route called allow-udp-636 and set the next hop to be the VM instance running the LDAP server

C :

Add a network tag of your choice to the instance. Create a firewall rule to allow ingress on UDP port 636 for that network tag

D :

Add a network tag of your choice to the instance running the LDAP server. Create a firewall rule to allow egress on UDP port 636 for that network tag.

Answer: C

Question 5

You need to create an autoscaling managed instance group for an HTTPS web application. You want to make sure that unhealthy VMs are recreated. What should you do?

Options :

A : Create a health check on port 443 and use that when creating the Managed Instance Group.

B : Select Multi-Zone instead of Single-Zone when creating the Managed Instance Group.

C : In the Instance Template, add the label ‘health-check’.

D : In the Instance Template, add a startup script that sends a heartbeat to the metadata server.

Answer: A