Your company's on-premises network is connected to a VPC using a Cloud VPN tunnel. You have a static route of 0.0.0.0/0 with the VPN tunnel as its next hop defined in the VPC. All internet bound traffic currently passes through the on-premises network. You configured Cloud NAT to translate the primary IP addresses of Compute Engine instances in one region. Traffic from those instances will now reach the internet directly from their VPC and not from the on-premises network. Traffic from the virtual machines (VMs) is not translating addresses as expected. What should you do?

• A. Add firewall rules that allow ingress and egress of the external NAT IP address, have a target tag that is on the Compute Engine instances, and have a priority value higher than the priority value of the default route to the VPN gateway.
• B. Lower the TCP Established Connection Idle Timeout for the NAT gateway.
• C. Increase the default min-ports-per-vm setting for the Cloud NAT gateway.
• D. Add a default static route to the VPC with the default internet gateway as the next hop, the network tag associated with the Compute Engine instances, and a higher priority than the priority of the default route to the VPN tunnel.

All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?

• A. Generate a new SSH key pair. Verify the format of the private key and add it to the instance.
  SSH into the instance using a third-party tool like putty or ssh.
• B. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
• C. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
• D. Generate a new SSH key pair. Verify the format of the public key and add it to the project.
  SSH into the instance using a third-party tool like putty or ssh.

You are integrating your company's on-premises SD-WAN fabric with Google Cloud to route traffic from application VPCs to your on-premises network. The SD-WAN appliance is already deployed as a virtual machine in a central hub VPC. You want to minimize operational complexity by using the SD-WAN virtual appliance for policy enforcement and dynamic route exchange.
What should you do?

• A. Place the SD-WAN appliance that is in the hub VPC in a backend service behind an internal passthrough Network Load Balancer. Create a custom route in the spoke VPC that uses the load balancer as the next hop.
• B. Establish a direct HA VPN connection from the application VPCs to the on-premises data center, and configure BGP to exchange dynamic routes directly.
• C. Create a Network Connectivity Center hub in the hub VPC, and register the SD-WAN virtual machine as a router appliance hybrid spoke. Add the application networks to the hub as VPC spokes.
• D. Peer the central hub and application VPCs. Create a static route in the application VPCs for the on-premises CIDR range with the next-hop set to the internal IP address of the SD-WAN appliance.

Your organization has multiple VMs running on Google Cloud within a VPC. The VMs require connectivity to certain Google APIs. You need to enable Private Google Access for VM connectivity to Cloud Storage. What should you do?

• A. Enable Private Google Access on the subnet, create a default route that points to the default internet gateway, and enable the Cloud Storage API.
• B. Enable Private Google Access on the VM, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
• C. Enable Private Google Access on the project, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
• D. Enable Private Google Access on the VPC, create a default route that points to the default internet gateway, and enable the Cloud Storage API.