You are configuring the cloud network architecture for a newly created project m Google Cloud that will host applications in Compote Engine Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region
* Instances in sub-a win have public IP addresses
* Instances in sub-b will have only private IP addresses
To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud You need to allow sub-b to access the external repository. What should you do?

• A. Enable Identity Aware Proxy for TCP forwarding for instances in sub-b
• B. Configure a bastion host instance in sub a to connect to instances in sub-b
• C. Enable Private Google Access on sub-b
• D. Configure Cloud NAT and select sub b m the NAT mapping section

Your company places a high value on being responsive and meeting customer needs quickly. Their primary business objectives are release speed and agility. You want to reduce the chance of security errors being accidentally introduced. Which two actions can you take? Choose 2 answers

• A. Use source code security analyzers as part of the CI/CD pipeline.
• B. Run a vulnerability security scanner as part of your continuous-integration /continuous-delivery (CI
  /CD) pipeline.
• C. Ensure you have stubs to unit test all interfaces between components.
• D. Ensure every code check-in is peer reviewed by a security SME.
• E. Enable code signing and a trusted binary repository integrated with your CI/CD pipeline.

You are a cloud architect for a financial services company that is building a new application on Google Kubernetes Engine (GKE). Currently, developers build container images on their workstations and manually push them to Artifact Registry. You need to design a secure CI/CD pipeline that automates the build and deployment process from your company ' s GitHub repository. The pipeline must ensure that only trusted, verified container images are deployed to the production GKE cluster and that every deployment can be traced back to its source code. What should you do?

• A. Connect your GitHub repository to Cloud Build, and create a trigger to automatically start builds on commits. Use the pipeline to build the container image, push it to Artifact Registry, and generate build provenance. Configure Binary Authorization with an attestor to require sign-off before deploying to the production GKE cluster using Cloud Deploy.
• B. Use Jenkins on Compute Engine to build container images from the GitHub repository and push them to Artifact Registry. Promote images by adding tags in the registry. Use a service account key file stored in the Jenkins instance to grant deployment permissions to the production GKE cluster.
• C. Create a Cloud Run function that triggers on changes to a Cloud Storage bucket where developers upload source code archives from GitHub. Have the function use Kaniko cache to build the image and push it to Artifact Registry. Use kubectl commands within the function to deploy the image to GKE.
• D. Connect your GitHub repository to Cloud Build to create the container images and store them in Artifact Registry. Write a custom script that runs on a schedule to check for new image tags in Artifact Registry and deploys the latest image to the production GKE cluster.

For this question, refer to the Mountkirk Games case study. Mountkirk Games wants you to design a way to test the analytics platform's resilience to changes in mobile network latency. What should you do?

• A. Build a test client that can be run from a mobile phone emulator on a Compute Engine virtual machine, and run multiple copies in Google Cloud Platform regions all over the world to generate realistic traffic.
• B. Deploy failure injection software to the game analytics platform that can inject additional latency to mobile client analytics traffic.
• C. Add the ability to introduce a random amount of delay before beginning to process analytics files uploaded from mobile devices.
• D. Create an opt-in beta of the game that runs on players ' mobile devices and collects response times from analytics endpoints running in Google Cloud Platform regions all over the world.