Your organization's application is running on a VPC-native GKE Standard cluster with public IP addresses. You need to configure access to the remote address range 35.100.0.0/16 through Cloud NAT, instead of using the GKE nodes' external IP addresses. SNAT is enabled on the cluster and needs to be configured. What should you do?

• A. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16 range in the list.
• B. Configure Cloud NAT and create an exclusion rule for any SNAT address translation.
• C. Configure Cloud NAT with nonMasqueradeCIDRs, and enable SNAT with the same configuration to allow traffic to 35.100.0.0/16.
• D. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16 range from the list.

Your organization requires that all SMTP traffic to your cloud environment is blocked, except for traffic that originates from your corporate network. Your organization also requires that only specific VPCs across your Google Cloud projects will allow SMTP access from your corporate network. You need to configure a security policy that will enable this connectivity. What should you do?

• A. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the source of your corporate network, TCP port 25, and the goto_next action.
  2. Configure an ingress hierarchical firewall rule with priority 10010 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
  3. Associate the hierarchical firewall policy at the organization level.
  4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
• B. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
  2. Associate the hierarchical firewall policy at the organization level.
  3. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
• C. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the allow action.
  2. Associate the hierarchical firewall policy at the organization level.
  3. Configure firewall policy rules to deny TCP port 25 in the firewall policies associated with the respective VPCs that do not require that access.
• D. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
  2. Configure an egress hierarchical firewall rule with priority 10010 specifying the source of your corporate network as TCP port 25 and the goto_next action.
  3. Associate the hierarchical firewall policy at the organization level.
  4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.

You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider.
The connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?

• A. Enable the Firewall Insights API. Set the Deny rule insights observation period to one day.Review Insight results to assure there are no firewall rules denying traffic.
• B. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors that match the destination IP address of the public SaaS provider.
• C. Create a Connectivity Test. Review the results for configuration issues in the VPC routing table.
• D. Enable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider.

You have deployed a new internal application that provides HTTP and TFTP services to on- premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?

• A. Client IP, port and protocol
• B. None
• C. Client IP and protocol
• D. Client IP

You are designing the VPC network for a large enterprise with many development teams. You need to centralize the management of common network resources while allowing each development team the flexibility to provision and manage their own virtual machines and other compute resources within their respective projects. You also need to ensure that all applications can communicate securely within the corporate environment. What should you do?

• A. Implement a single large VPC for all development teams in one project and grant them specific IAM roles to manage resources within it.
• B. Create individual VPCs in each development project and establish VPC Network Peering connections between all of them.
• C. Configure Cloud VPN tunnels from each development project's VPC to a central network project that acts as a hub.
• D. Designate a host project to contain a Shared VPC network, and then attach each development team's project as a service project to share this network.