A. Create a design that uses the LOCAL_PREF BGP attribute to influence the egress path from Google Cloud to the on-premises environment.

B. Create a design that uses the AS_PATHBGP attribute to influence the egress path from Google Cloud to the on-premises environment.

C. Create a design that uses a BGP multi-exit discriminator (MED) attribute to influence the egress path from Google Cloud to the on-premises environment.

D. Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on- premises devices.

A. Create one global external Application Load Balancer and multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.

B. Create two global external Application Load Balancers with multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.

C. Create two global external Application Load Balancers with one backend service and one backend. Point each back end to a different instance group.

D. Create one global external Application Load Balancer and one backend service with multiple backends. Point each backend to a different instance group.

A. Enable Firewall Rules Logging inside the third project.

B. Monitor the Resource Manager audit logs inside the perimeter.

C. Modify the existing VPC Service Controls policy to include the new project in dry run mode.

D. Enable VPC Flow Logs inside the third project, and monitor the logs for negative impact.

A. Configure Firewall Rules Logging.
Use Firewall Insights to display the number of hits.

B. Configure a firewall appliance from the Google Cloud Marketplace.
Route all traffic through this appliance, and apply the firewall rules at this layer.
Use the firewall appliance to display the number of hits.

C. Configure Firewall Rules Logging.
View the logs in Cloud Logging, and create a custom dashboard in Cloud Monitoring to display the number of hits.

D. Configure Packet Mirroring on the VPC. Apply a filter with an IP address list of the Denied Firewall rules.
Configure an intrusion detection system (IDS) appliance as the receiver to display the number of hits.

A. Create a network load balancer that used backend services containing one instance group with two instances.

B. Create a network load balancer that uses a target pool backend with two instances.

C. Create a TCP proxy that uses a zonal network endpoint group containing one instance.

D. Create a TCP proxy that uses backend services containing an instance group with two instances.

A. Create a Network Connectivity Center hub in star topology. Configure the inspection VPC spoke as a center group that advertises a default route, and configure the application VPCs as edge spokes to use that route for inter-VPC traffic.

B. Use VPC Network Peering to create a full mesh by peering all three VPCs with each other, and then use firewall rules to deny all traffic between App-A and App-B.

C. Create a Network Connectivity Center hub in mesh topology, connect all three VPCs as spokes, and configure the inspection VPC to advertise the default route.

D. Create two separate VPC Network Peering connections: One between the inspection VPC and App-A, and another between the inspection VPC and App-B.

A. Create a new health check using the VPC Network section in the GCP Console.

B. Create a new health check using the gcloud command line tool.

C. Create a new legacy health check using the Health checks section in the GCP Console.

D. Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the GCP Console.

E. Create a new legacy health check using the gcloud command line tool.

A. Implement a Direct Peering connection from your co-location facility to Google's global network edge.

B. Configure a pair of HA VPN tunnels between the on-premises data center and the Google Cloud VPC.

C. Engage with a Google Cloud Partner to establish a Partner Interconnect connection for your private network.

D. Order a pair of Dedicated Interconnect circuits at the colocation facility to a Google edge location, then configure a VLAN attachment within your Google Cloud VPC.

A. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project A for the reported metric.

B. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project A for the reported metric.

C. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project B for the reported metric.

D. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project B for the reported metric.

A. Create a sub-domain named internal.terramearth.com. Add the new DNS entry (myglobalapp.internal.terramearth.com) to the sub-domain pointing to the internal IP address from the application VM.

B. Configure a private zone for the application record (myglobalapp.terramearth.com) and point to the internal IP address of the application VM. Bind this zone to the VPC.

C. Configure a query logic script inside Cloud DNS to check the source IP address from the VPC, and respond with a modified DNS record to include the internal IP address from the application VM.

D. Promote the ephemeral IP address from the application VM to static, add this static ip address to each internal client's host file, and change the myglobalapp.terramearth.com DNS record to this new static IP address.

A. Use HA VPN on top of Interconnect to establish a BGP session to your on-premise router.
Configure the Cloud Router to advertise all visible subnets.

B. Implement a policy-based route in your Google Cloud VPC network to forward all on-premises destined traffic to a Network Virtual Appliance (NVA).

C. Deploy a Cloud Router in your Google Cloud VPC network configured to advertise all subnets visible to the Cloud Router. Establish a BGP session over your Cloud Interconnect VLAN attachment to your on-premises router.

D. Use a Cloud Function triggered by network monitoring logs to automatically script and update static routes in the VPC route table for any detected on-premises subnets.

A. Use a weighted round-robin (WRR) policy to specify different weights per regional load balancer, assigning higher weights to the regional load balancers.

B. Configure a failover routing policy where the primary backend is dynamically set to the region with the lowest latency, with the other regions serving as hot standbys.

C. Create a record set for shop.example.com using a Cloud DNS geolocation route policy that maps traffic originating from source geographies to the corresponding regional load balancer.

D. Create a single "A" record for shop.example.com with all three regional load balancer IP addresses.