You are running an application on multiple virtual machines within a managed instance group and have autoscaling enabled. The autoscaling policy is configured so that additional instances are added to the group if the CPU utilization of instances goes above 80%. VMs are added until the instance group reaches its maximum limit of five VMs or until CPU utilization of instances lowers to 80%. The initial delay for HTTP health checks against the instances is set to 30 seconds. The virtual machine instances take around three minutes to become available for users. You observe that when the instance group autoscales, it adds more instances then necessary to support the levels of end-user traffic. You want to properly maintain instance group sizes when autoscaling.
What should you do?

• A. Increase the initial delay of the HTTP health check to 200 seconds.
• B. Decrease the maximum number of instances to 3.
• C. Use a TCP health check instead of an HTTP health check.
• D. Set the maximum number of instances to 1.

Your company set up a complex organizational structure on Google Could Platform. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members and you want to follow Google-recommended practices. What should you do?

• A. Add the users to roles/iam.roleViewer role.
• B. Add the users to roles/browser role.
• C. Add the users to a group, and add this group to roles/iam.roleViewer role.
• D. Add the users to a group, and add this group to roles/browser role.

Your company uses BigQuery to store and analyze data. Upon submitting your query in BigQuery, the query fails with a quotaExceeded error. You need to diagnose the issue causing the error. What should you do? (Choose two.)

• A. View errors in Cloud Monitoring to analyze the issue.
• B. Use the INFORMATION_SCHEMA views to analyze the underlying issue.
• C. Use BigQuery BI Engine to analyze the issue.
• D. Search errors in Cloud Audit Logs to analyze the issue.
• E. Configure Cloud Trace to analyze the issue.

You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?

• A. - Create a service account sa-app and a network tag db-server.
  - Associate the service account sa-app with the application servers and the network tag db-server with the database servers.
  - Create an ingress firewall rule to allow network traffic from source VPC IP addresses and target the subnet-a IP addresses.
• B. - Create a network tag app-server and service account sa-db.
  - Add the tag to the application servers and associate the service account with the database servers.
  - Create an egress firewall rule to allow network traffic from source network tag app-server to target service account sa-db.
• C. - Create service accounts sa-app and sa-db.
  - Associate service account sa-app with the application servers and the service account sa-db with the database servers.
  - Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db.
• D. - Create network tags app-server and db-server.
  - Add the app-server tag to the application servers and the db-server tag to the database servers.
  - Create an egress firewall rule to allow network traffic from source network tag app-server to target network tag db-server.

Your team is using Linux instances on Google Cloud. You need to ensure that your team logs in to these instances in the most secure and cost efficient way. What should you do?

• A. Use a third party tool to provide remote access to the instances.
• B. Attach a public IP to the instances and allow incoming connections from the internet on port 22 for SSH.
• C. Create a bastion host with public internet access. Create the SSH tunnel to the instance through the bastion host.
• D. Use the gcloud compute ssh command with the --tunnel-through-iap flag. Allow ingress traffic from the IP range 35.235.240.0/20 on port 22.