Set up the engineer with Compute Shared VPC Admin IAM role at the folder level.

Set up the engineer with Compute Shared VPC Admin IAM role at the organization level.

Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin
role at the folder level.

Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin
role at the organization level.

Order a Dedicated Interconnect connection in the same metropolitan area. Create a
VLAN attachment, a Cloud Router in us-west1, and a Border Gateway Protocol (BGP)
session between your Cloud Router and your router.

Order a Direct Peering connection in the same metropolitan area. Configure a Border
Gateway Protocol (BGP) session between Google and your router.

Configure HA VPN in us-west1. Configure a Border Gateway Protocol (BGP) session between your Cloud Router and your on-premises data center.

Order a Carrier Peering connection in the same metropolitan area. Configure a Border
Gateway Protocol (BGP) session between Google and your router.

resource.type= “gce_router”

resource.type= “gce_network_region”

resource.type= “vpn_tunnel”

resource.type= “vpn_gateway”

In the Network Intelligence Canter, check for the number of packet drops on the VPN.

In the Google Cloud Console, use Monitoring Query Language to create a custom alert
for bandwidth utilization

In the Monitoring section of the Google Cloud Console, use the Dashboard section to
select a default dashboard for VPN usage.

In the VPN section of the Google Cloud Console, select the VPN under hybrid
connectivity, and then select monitoring to display utilization on the dashboard

/21

/22

/23

/25

Create a secure perimeter using the Access Context Manager feature of VPC Service
Controls and restrict access to the source IP range of the allowed clients and Google
health check IP ranges.

Create a secure perimeter using VPC Service Controls, and mark the load balancer as a
service restricted to the source IP range of the allowed clients and Google health check IP
ranges.

Tag the backend instances "application," and create a firewall rule with target tag
"application" and the source IP range of the allowed clients and Google health check IP
ranges.

Label the backend instances "application," and create a firewall rule with the target label
"application" and the source IP range of the allowed clients and Google health check IP
ranges.

Create a GKE private cluster with a private endpoint for the control plane. Configure
VPC Networking Peering export/import routes and custom route advertisements on the
Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.

Create a GKE private cluster with a public endpoint for the control plane. Configure VPC
Networking Peering export/import routes and custom route advertisements on the Cloud
Routers.

Create a GKE private cluster with a private endpoint for the control plane. Configure
authorized networks to specify the desired on-premises subnets.

Create a GKE public cluster. Configure authorized networks to specify the desired onpremises
subnets.

You have not configured compression in Cloud CDN.

You have configured the web servers and Cloud CDN with different compression types.

The web servers behind the load balancer are configured with different compression
types.

You have to configure the web servers to compress responses even if the request has a
Via header.