Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space.
You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
- Your ISP is a Google Partner Interconnect provider.
- Your on-premises VPN device's internet uplink and downlink speeds are
10 Gbps.
- A test VPN connection between your on-premises gateway and GCP is
performing at a maximum speed of 500 Mbps due to packet losses.
- Most of the data transfer will be from GCP to the on-premises
environment.
- The application can burst up to 1.5 Gbps during peak transfers over
the Interconnect.
- Cost and the complexity of the solution should be minimal.
How should you provision the connectivity solution?

• A. Provision a Dedicated Interconnect instead of a VPN.
• B. Use network compression over your VPN to increase the amount of data you can send over your VPN.
• C. Provision a Partner Interconnect through your ISP.
• D. Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.

You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial- of-service and application layer (layer 7) attacks. What should you do?

• A. Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.
• B. Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.
• C. Configure VPC firewall rules to protect the Compute Engine instances against distributed denial- of-service attacks.
• D. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.

Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?

• A. Network load balancer
• B. SSL proxy load balancer
• C. HTTPS load balancer
• D. TCP proxy load balancer

Your organization deployed a mission critical application that is expected to be a new revenue source. As part of the planning and deployment process, you have recently implemented a security profile with the default set of threat signatures provided by Cloud Next Generation Firewall (Cloud NGFW). This application is the only application running on this project. You need to increase the security posture of the application to log the threat and drop the related packets.
What should you do?

• A. Configure Cloud Scheduler to run a task that checks the Cloud NGFW logs to verify the threats.Configure the task to create a security profile with each signature ID set to override the default action.
• B. Configure a new default threat signature with Deny All to all severity options. Review the logs to understand the impact.
• C. Set up a Linux VM as the frontend gateway for the application. Create iptables rules to drop all packets, excluding the application port.
• D. For all severity options (critical, high, medium, low and informational) in the security profile, change the default override action to Deny.

You have several microservices running in a private subnet in an existing Virtual Private Cloud (VPC). You need to create additional serverless services that use Cloud Run and Cloud Functions to access the microservices. The network traffic volume between your serverless services and private microservices is low. However, each serverless service must be able to communicate with any of your microservices. You want to implement a solution that minimizes cost. What should you do?

• A. Create a serverless VPC access connector. Configure the serverless service to use the connector for communication to the microservices.
• B. Deploy your serverless services to the serverless VPC. Peer the serverless service VPC to the existing VPC. Configure firewall rules to allow traffic between the serverless services and your existing microservices.
• C. Deploy your serverless services to the existing VPC. Configure firewall rules to allow traffic between the serverless services and your existing microservices.
• D. Create a serverless VPC access connector for each serverless service. Configure the connectors to allow traffic between the serverless services and your existing microservices.