You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires: ✑ as close to 100% system availability as possible ✑ cost optimization You need to design the connectivity between the locations to meet the business requirements. What should you provision?
Answer(s): A
The correct answer is A: An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway. This solution optimally balances high availability and cost for the given requirements.Justification:High Availability: HA Cloud VPN utilizes two interfaces to create redundant VPN tunnels connecting to the on-premise VPN gateway. If one tunnel or interface fails, traffic automatically shifts to the other, ensuring continuous connectivity and maximizing system availability, which is a core business requirement. Cost Optimization: While multiple gateways might seem like a robust solution, HA Cloud VPN offers redundancy within a single, managed service, optimizing for cost compared to deploying multiple independent gateways and their associated infrastructure. Using two tunnels per HA VPN gateway provides the necessary redundancy without incurring the expense of multiple gateways. Throughput Requirement: The 200 kbps throughput is quite low. HA Cloud VPN tunnels can easily handle this level of traffic and are typically sized for much higher capacity, making it a suitable fit. Avoidance of Redundant Gateways: Option B and C propose multiple gateways which increase complexity and cost without significant added value for the given throughput and availability needs. Option D presents a single point of failure. HA VPN inherently offers the needed redundancy. Simplicity: Using a single HA VPN setup, as proposed in option A, simplifies the configuration and management compared to options B and C which would require managing multiple gateways.Relevant Cloud Computing Concepts:High Availability (HA): Designing systems to minimize downtime and ensure continuous operation, often through redundancy. Virtual Private Network (VPN): A secure encrypted tunnel that creates a private connection across a public network. Cloud VPN: Google Cloud's service to create VPN connections to other networks using IPsec VPN tunnels. Active-Active Redundancy: Both tunnels actively route traffic, providing more bandwidth and redundancy. Cost-Optimization: Choosing the most efficient resource usage to minimize expenditure.Authoritative Links:Cloud VPN Overview: https://cloud.google.com/vpn/docs/concepts/overview HA VPN: https://cloud.google.com/network-connectivity/docs/vpn/concepts/ha-vpn Choosing a Cloud VPN Topology: https://cloud.google.com/network-connectivity/docs/vpn/how-to/choosing-a-topologyIn conclusion, utilizing a single HA Cloud VPN gateway with dual tunnels efficiently addresses the requirement for both high availability and cost optimization for this specific scenario. The low bandwidth needs do not justify a more complex and costly multi-gateway approach.
Your company has an application running on App Engine that allows users to upload music files and share them with other people. You want to allow users to upload files directly into Cloud Storage from their browser session. The payload should not be passed through the backend. What should you do?
Here's a detailed justification for why option A is the correct solution, along with explanations of why the other options are incorrect:Justification for Option A:Option A correctly addresses the requirement of direct browser uploads to Cloud Storage, bypassing the App Engine backend. This is achieved through two key steps:1. CORS Configuration: Cross-Origin Resource Sharing (CORS) is crucial for web applications to interact with resources from different origins (domains). Since the App Engine application is hosted on one domain and the Cloud Storage bucket on another, a CORS configuration on the bucket is required. This configuration specifies which origins (in this case, the base URL of the App Engine application) are permitted to make requests to the bucket. Without proper CORS, browser security mechanisms will block direct uploads. This is an important security consideration, allowing resources from different origins to interact with each other without having unrestricted access.2. Signed URL: A Signed URL is a time-limited URL that grants specific permissions to access a Cloud Storage resource. By generating a POST-type Signed URL, the application can provide a user’s browser with the necessary credentials to directly upload a file to the designated location in Cloud Storage. This avoids the need for the server to receive the file initially and then relay it to Cloud Storage, reducing server load and latency.Therefore, Option A correctly uses both CORS and Signed URLs to achieve direct browser uploads without the backend's involvement.Why other Options are Incorrect:Option B: While setting a CORS configuration is correct, assigning the Cloud Storage WRITER role directly to users is a significant security risk. Users shouldn't have direct permanent write access to the bucket. This would violate the principle of least privilege, providing excessive access and leading to potential security vulnerabilities.Option C: While using Signed URLs is correct for client-side uploads, App Engine default credentials are not intended for granting client access. They should be used only to access services from within your App Engine application for server-to-server communication. Using them directly exposes sensitive information and presents a security risk.Option D: This option combines the major issues of B and C, by directly granting WRITER role and improperly using default credentials, further amplifying the security vulnerabilities.Authoritative Links for Further Research:Cloud Storage CORS: https://cloud.google.com/storage/docs/configuring-cors Cloud Storage Signed URLs: https://cloud.google.com/storage/docs/access-control/signed-urls Principle of Least Privilege: https://en.wikipedia.org/wiki/Principle_of_least_privilegeIn conclusion, option A is the only solution that correctly and securely enables direct browser uploads to Cloud Storage, adhering to best practices and avoiding potential security risks.
You are configuring the cloud network architecture for a newly created project in Google Cloud that will host applications in Compute Engine. Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region: •Instances in sub-a will have public IP addresses. •Instances in sub-b will have only private IP addresses. To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud. You need to allow sub-b to access the external repository. What should you do?
Answer(s): B
Here's a detailed justification for why option B, "Configure Cloud NAT and select sub-b in the NAT mapping section," is the correct solution:The core requirement is to allow instances in sub-b , which have private IP addresses, to access external resources (a public repository) without directly exposing them to the internet. Cloud NAT (Network Address Translation) is designed precisely for this purpose. It allows instances within a private network to initiate outbound connections to the internet by translating their private IP addresses to a public IP address belonging to the Cloud NAT gateway. This ensures that outbound traffic appears to originate from a public IP address instead of the internal ones.Option A, enabling Private Google Access, allows instances with private IP addresses to access Google Cloud APIs and services, but it doesn't enable access to arbitrary external endpoints. Thus, it would not solve the problem of accessing a public repository outside Google Cloud. Option C, using a bastion host, adds unnecessary complexity. While a bastion host can provide connectivity, it requires managing an additional instance and setting up forwarding rules. Cloud NAT is a more direct and scalable solution. Option D, Identity-Aware Proxy, focuses on controlling access to applications and resources; it’s not relevant for basic outbound internet connectivity.By configuring Cloud NAT and selecting sub-b in the NAT mapping, the instances in sub-b can send traffic through the NAT gateway. The gateway will translate the source IP addresses of these instances to a public IP address, allowing access to the external repository. Return traffic is directed back to the private instance using NAT. This way, instances in sub-b can access the internet without needing their own public IPs, adhering to best practices for security and network management. Cloud NAT scales automatically based on demand making it a robust solution.Authoritative Links:Cloud NAT Overview: https://cloud.google.com/nat/docs/overview Configuring Cloud NAT: https://cloud.google.com/nat/docs/using-nat Private Google Access: https://cloud.google.com/vpc/docs/private-access-options
Your company is planning to migrate their Windows Server 2022 from their on-premises data center to Google Cloud. You need to bring the licenses that are currently in use in on-premises virtual machines into the target cloud environment. What should you do?
Answer(s): D
The correct answer is D because it outlines the proper procedure for migrating Windows Server 2022 licenses to Google Cloud using the bring-your-own-license (BYOL) model via sole-tenancy nodes. Option D starts by creating an image of the on-premises virtual machine, capturing its operating system, applications, and configurations. This image is then imported into Compute Engine, specifically specifying the operating system as windows-2022-dc-v which indicates a BYOL license. The key step is then creating a sole-tenancy instance.Sole-tenancy nodes allow customers to bring their existing Windows Server licenses, aligning with the requirement of utilizing current on-premises licenses. BYOL is the recommended and cost-effective approach in such scenario. Option A is incorrect as importing the image without specifying the OS does not allow proper license mapping. Option B is incorrect because creating standard Compute Engine instances uses Google's licenses, not your own, failing to fulfill the BYOL requirement. Option C is also incorrect. Creating a separate standard instance and then attaching a data disk does not correctly handle Windows licenses. Instead, the OS disk needs to be from the image you provide that has the existing windows setup, and needs to be run in a sole-tenancy node for license purposes. Sole tenancy and BYOL are critical for compliance and cost optimization in this scenario.Supporting Links:Google Cloud Sole-Tenancy Nodes: https://cloud.google.com/compute/docs/nodes/sole-tenant-nodesBring Your Own License (BYOL): https://cloud.google.com/licensing Importing Virtual Disks: https://cloud.google.com/compute/docs/import/import-virtual-disks
You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires: •99.99% system availability •cost optimization You need to design the connectivity between the locations to meet the business requirements. What should you provision?
Option A, an HA Cloud VPN gateway with two tunnels to an on-premises VPN gateway, is the correct choice because it provides the required 99.99% availability and cost optimization for the described scenario. High Availability (HA) Cloud VPN gateways inherently provide redundancy by having two interfaces, meaning that the connection remains active even if one interface fails. The use of two tunnels enhances this redundancy, ensuring that if one tunnel experiences issues, the other can maintain the connection. A single HA gateway is more cost-effective than using two full HA gateways as in Option C, while still meeting the high availability requirement. Option B, using a Classic Cloud VPN, doesn’t meet the 99.99% availability target as classic VPN gateways lack inherent redundancy. Option D, while cost-effective, sacrifices availability with a single point of failure. Option C is overkill for a relatively low 200 kbps throughput and doesn't contribute substantially to increased performance. It would also unnecessarily increase costs. The HA VPN solution with two tunnels provides a balance of reliability and cost efficiency, leveraging the HA feature for failover protection of the primary connection. This solution ensures a stable and resilient connection for the application’s private network communication needs while remaining within budget constraints. For further information, refer to Google's documentation on Cloud VPN: https://cloud.google.com/vpn/docs/concepts/overview , specifically on HA VPN configuration.
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.