Question 1

You need to ensure your personal SSH key works on every instance in your project. You want to accomplish

this as efficiently as possible.

What should you do?

Options :

A : Upload your public ssh key to the project Metadata.

B : Upload your public ssh key to each instance Metadata.

C : Create a custom Google Compute Engine image with your public ssh key embedded.

D : Use gcloud compute ssh to automatically copy your public ssh key to the instance.

Answer: A

Question 2

You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non

BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your

network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.

What should you do?

Options :

A :

Create a Cloud VPN instance.• Create a policy-based VPN tunnel per subnet.• Configure the appropriate local and remote traffic selectors to match your local and remote networks.• Create the appropriate static routes.

B :

Create a Cloud VPN instance.• Create a policy-based VPN tunnel.• Configure the appropriate local and remote traffic selectors to match your local and remote networks.• Configure the appropriate static routes

C :

Create a Cloud VPN instance.• Create a route-based VPN tunnel.• Configure the appropriate local and remote traffic selectors to match your local and remote networks.• Configure the appropriate static routes.

D :

Create a Cloud VPN instance.• Create a route-based VPN tunnel.• Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.• Configure the appropriate static routes.

Answer: B

Question 3

You are adding steps to a working automation that uses a service account to authenticate. You need to drive

the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the

least privilege possible.

What should you do?

Options :

A : Grant the compute.instanceAdmin to your user account.

B : Grant the iam.serviceAccountUser to your user account.

C : Grant the read-only privilege to the service account for the Cloud Storage bucket.

D : Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.

Answer: C

Question 4

You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partners project while minimizing the amount of infrastructure required Your partners services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?

Options :

A : Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partners VPC. Connect your VPN gateways to the partners gateways. Enable global dynamic routing in each VPC.

B : Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner-s VPC. Conned your VPN gateway to your partner-s servers.

C : Create one OpenVPN Access Server in each region of your VPC and your partners VPC. Connect your servers to the partner-s servers.

D : Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partners VPC. Connect your VPN gateways to the partners gateways with a pair of tunnels Enable global dynamic routing in each VPC

Answer: A

Question 5

You have the networking configuration shown. In the diagram Two VLAN attachments associated With two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BOP) sessions associated with each Of the VLAN attachments. You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?

Options :

A :

From the Google Cloud console, navigate to the Hybrid Connectivity select the Cloud Router, and view BGP sessions.

B :

From the Cloud CLI, run gcloud compute –protect_ID router get—status mycloudrouter —-region REGION and review the results.

C :

From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results

D :

From the Cloud CLI. run gcloud compute routers describe mycloudrouter --region REGION and review the results

Answer: A