This is one of the most difficult question. I hope I don t get that in my exam.
A = I think the example in “Getting uptime-check IP addresses” in https://cloud.google.com/monitoring/uptime-checks/ is pretty much what the question states. I would choose this one.
B = B is also a possibility. The problem I see here is that in https://cloud.google.com/monitoring/agent/ states “Using the Monitoring agent is optional but recommended. ” and “Monitoring can access some metrics without the Monitoring agent, including CPU utilization, some disk traffic metrics, network traffic, and UPTIME information. Monitoring uses the Monitoring agent to access additional system resources and application services in virtual machine (VM) instances. If you want these additional capabilities, you should install the Monitoring agent.” So, you can access uptime info without agent.
C = the “Identifying uptime check traffic” section of https://cloud.google.com/monitoring/uptime-checks/ explains how you can identify the stackdriver monitoring entries in the logs. This is done if the header has the following User-Agent header: GoogleStackdriverMonitoring-UptimeChecks(https://cloud.google.com/monitoring)
C is definitely more restrictive than A and so it is a best practice to be more restrictive. Why not C then? I would not choose C for 3 reasons: 1) Option A has to be done anyway 2) the example I mentioned in A matches exactly what the question states 3) the question talks about legacy services and the option C talks about legacy web servers only. It is possible not all legacy services are in web servers
D = I think Amar Honnungar got that right

A no doubts.

Why not B? If servers are located not at GCP.

D may not be right as the Uptime check when hits the loadBalancer VIP, will always show as UP until even 1 of the legacy server at the backend are up and running. So the Uptime check should be done against the legacy webservers directly So C is correct

I think answer should be A. See https://cloud.google.com/monitoring/uptime-checks/

If you are checking a service that is behind a firewall, you can configure your service's firewall to accept traffic from the current set of IP addresses used for uptime checking. To get the IP addresses, use the following instructions:

1. Go to the Uptime Checks page for your project.
In the More menu next to Add Uptime Check, select Download Source IPs:

Uptime check download IPs

The returned information typically contains about 20 IP addresses. Uptime checks can come from any of the IP addresses, but only one address from each geographic location is used for each time interval. The geographic locations are listed in the uptime checks dashboard, shown in the previous section.