Professional-Cloud-Network-Engineer Practice Test Questions Updated 172 Questions
Google Professional-Cloud-Network-Engineer Dumps - Secret To Pass in First Attempt
Exam Topics
To pass the Google Professional Cloud Network Engineer certification exam, the candidates must have a good comprehension of the topics covered in it. The test takers are recommended to go through the official guide to get a comprehensive understanding of the knowledge areas they need to develop mastery in. The highlights of the domains that make part of the exam syllabus are provided below:
- Implementation of Hybrid Interconnectivity
The technical tasks covered in this section include the configuration of interconnect, configuration of site-to-site IP Security VPN (including policy-based, route-based, dynamic/static routing), as well as configuration of Cloud Router for reliability.
- Implementation of Virtual Private Cloud (VPC) on Google Cloud Platform
Within this subject area, the examinees will be evaluated based on their ability to configure Virtual Private Clouds as well as configure routing. They will also be asked to demonstrate their proficiency in configuring & maintaining the Google Kubernetes Engine clusters and firewall rules.
- Configuration of Network Services
To answer the questions related to this domain, the individuals need to have the competency in configuring load balancing, configuring Cloud Content Delivery Network (CDN), configuring & maintaining Cloud Domain Name System (DNS), as well as enabling additional network services.
- Optimization of Network Resources
The last objective of the certification exam focuses on the ability of the specialists to perform the optimization of traffic flow. This includes their understanding of load balancer & CDN location, global versus regional dynamic routing, expansion of subnet Classless Inter-Domain Routing (CIDR) ranges in service, as well as accommodation of workload increases (for instance, autoscaling versus manual scaling). The individuals will also need to prove that they know how to perform the optimization for cost and efficiency. This involves cost optimization, automation, VPN versus interconnect, and bandwidth utilization.
- Google Cloud Platform Network Designing, Planning & Prototyping
This topic measures the skills of the candidates in designing the general network architecture, designing a hybrid network, as well as designing Virtual Private Cloud (VPC). The applicants should also be capable of designing the container IP addressing plan for the Google Kubernetes Engine.
- Implementation of Network Security
Here the students will need to demonstrate their skills in configuring Identity & Access Management (IAM). This part also requires their proficiency in configuring the Cloud Armor policies as well as configuring the third-party device incorporation into Virtual Private Cloud with the help of multi-nic (NGFW). Besides that, the applicants should know how to perform the management of keys for Secure Shell (SSH) access.
NEW QUESTION # 51
You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider.
Which connection type should you choose?
- A. Carrier Peering
- B. Dedicated Interconnect
- C. Direct Peering
- D. Partner Interconnect
Answer: C
Explanation:
Reference:
https://cloud.google.com/interconnect/docs/how-to/direct-peering
NEW QUESTION # 52
Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API for your on-premises servers. The configuration must meet the following requirements:
Certain data must stay in the project where it is stored and not be exfiltrated to other projects.
Traffic from servers in your data center with RFC 1918 addresses do not use the internet to access Google Cloud APIs.
All DNS resolution must be done on-premises.
The solution should only provide access to APIs that are compatible with VPC Service Controls.
What should you do?
- A. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates. - B. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Configure your on-premises firewalls to allow traffic to the restricted.googleapis.com addresses. - C. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Configure your on-premises firewalls to allow traffic to the private.googleapis.com addresses. - D. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
Answer: A
NEW QUESTION # 53
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- B. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
- C. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
- D. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION # 54
You create multiple Compute Engine virtual machine instances to be used as TFTP servers.
Which type of load balancer should you use?
- A. SSL proxy load balancer
- B. HTTP(S) load balancer
- C. Network load balancer
- D. TCP proxy load balancer
Answer: C
Explanation:
"TFTP is a UDP-based protocol. Servers listen on port 69 for the initial client-to-server packet to establish the TFTP session, then use a port above 1023 for all further packets during that session. Clients use ports above 1023" https://docstore.mik.ua/orelly/networking_2ndEd/fire/ch17_02.htm Besides, Google Cloud external TCP/UDP Network Load Balancing (after this referred to as Network Load Balancing) is a regional, non-proxied load balancer. Network Load Balancing distributes traffic among virtual machine (VM) instances in the same region in a Virtual Private Cloud (VPC) netw
NEW QUESTION # 55
You need to configure the Border Gateway Protocol (BGP) session for a VPN tunnel you just created between two Google Cloud VPCs, 10.1.0.0/16 and 172.16.0.0/16. You have a Cloud Router (router-1) in the 10.1.0.0/16 network and a second Cloud Router (router-2) in the 172.16.0.0/16 network. Which configuration should you use for the BGP session?
- A.
- B.
- C.
- D.
Answer: A
NEW QUESTION # 56
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale.
How should you provision your instances?
- A. Create an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.
- B. Create a single managed instance group, specify the desired region, and select Multiple zones for the location.
- C. Create an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.
- D. Create a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance- groups
NEW QUESTION # 57
You have the following private Google Kubernetes Engine (GKE) cluster deployment:
You have a virtual machine (VM) deployed in the same VPC in the subnetwork kubernetes-management with internal IP address 192.168.40 2/24 and no external IP address assigned. You need to communicate with the cluster master using kubectl. What should you do?
- A. Add the network 192.168.40.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2.
- B. Add the network 192.168.38.0/28 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
- C. Add an external IP address to the VM, and add this IP address in the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 35.224.37.17.
- D. Add the network 192.168.36.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
Answer: A
NEW QUESTION # 58
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- B. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
- C. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
- D. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
Answer: C
Explanation:
Once you have the exported file from your other provider, you can use the gcloud dns record-sets import command to import it into your managed zone.
To import record-sets, you use the dns record-sets import command. The --zone-file-format flag tells importto expect a BIND zone formatted file. If you omit this flag, import expects a YAML- formatted records file.
https://medium.com/@prashantapaudel/gcp-certification-series-2-4-planning-and-configuring- network-resources-8045ac2cc2ac
NEW QUESTION # 59
You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
- A. Create a private forwarding zone in Cloud DNS for 'corp altostrat.com' called corp-altostrat-com that points to 192. 168.20.88. Associate the zone with the hub VPC.
Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
Sat a custom route advertisement on the Cloud Router for 35.199.192.0/19.
Create a hub and spoke VPN deployment in each spoke VPC to connect back to the hub VPC. - B. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC.
Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
Create a hub-and-spoke VPN deployment in each spoke VPC to connect back to the on-premises network directly. - C. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
Associate the zone with the hub VPC. Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke PCs, with the hub VPC as the target.
Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. - D. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC.
Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
Configure VPC peering in the spoke VPCs to peer with the hub VPC.
Answer: D
NEW QUESTION # 60
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?
- A. Organization Admin privileges from the Organization Admin.
- B. Security Admin privileges from the Shared VPC Admin.
- C. Shared VPC Admin privileges from the Organization Admin.
- D. Service Project Admin privileges from the Shared VPC Admin.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION # 61
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* BGP sessions are established between both on-premises routers and the Cloud Router.
* Only 1 of the on-premises router's routes are being added to the routing table.
What is the most likely cause of this problem?
- A. The ASNs being used on the on-premises routers are different.
- B. A firewall is blocking the traffic across the second VPN connection.
- C. You do not have a load balancer to load-balance the network traffic.
- D. The on-premises routers are configured with the same routes.
Answer: C
NEW QUESTION # 62
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- B. Add a second Cloud VPN gateway in a different region than the existing VPN gateway.
Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address. - C. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- D. Add a second on-premises VPN gateway with a different public IP address.
Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
Answer: A
Explanation:
https://cloud.google.com/vpn/docs/concepts/classic-topologies
NEW QUESTION # 63
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Manually patch some of the instances, and then perform a rolling restart on the instance group.
- B. Deploy a new instance group and canary the updated template in that group.
Verify the new feature in the new canary instance group, and then update the original instance group. - C. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template.
Verify the new feature on the canary instances, and then roll forward to the rest of the instances. - D. Using the new instance template, perform a rolling update across all instances in the instance group.
Verify the new feature once the rollout completes.
Answer: B
Explanation:
https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances
NEW QUESTION # 64
All the instances in your project are configured with the custom metadata enable-osloginvalue set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project- wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- B. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- C. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- D. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION # 65
You work for one of the biggest digital media company in USA .The company management has decided to move 90 TB of backups and archival data to Google Cloud. They are looking for long term cost effective archival storage for disaster recovery in Google Cloud . Please select the right solution.
- A. Transfer Appliance and Nearline storage
- B. Storage Transfer and Nearline storage
- C. Transfer Appliance and Coldline storage
- D. gsutil and Cloud storage
Answer: C
Explanation:
Option B is the correct choice because ,Transfer Appliance is the best choice moving large volume of data and since they are looking for long term cost effective disaster recovery solution , coldline is the best option.
Option A is Incorrect because Storage Transfer is used to import online data into Cloud Storage .
Your online data source can be an Amazon Simple Storage Service (Amazon S3) bucket, an HTTP/HTTPS location, or a Cloud Storage bucket Option C is Incorrect because , gsutil isn't recommended for large volume of data transfer ,It will take a very long time for data transfer depending on the bandwidth.
Option D is Incorrect because , Coldline is a more cost effective archival storage for disaster recovery.
NEW QUESTION # 66
You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on- premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team's requirements?
- A. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - B. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
Create a custom route that points Google's private API address range to the default internet gateway as the next hop. - C. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google's private AP address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - D. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
Answer: C
NEW QUESTION # 67
You need to define an address plan for a future new Google Kubernetes Engine (GKE) cluster in your Virtual Private Cloud (VPC). This will be a VPC-native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses. Which subnet mask should you use for the Pod IP address range?
- A. /23
- B. /25
- C. /22
- D. /21
Answer: D
NEW QUESTION # 68
You have an HA VPN connection with two tunnels running in active/passive mode between your Virtual Private Cloud (VPC) and on-premises network. Traffic over the connection has recently increased from 1 gigabit per second (Gbps) to 4 Gbps, and you notice that packets are being dropped. You need to configure your VPN connection to Google Cloud to support 4 Gbps. What should you do?
- A. Configure a second set of active/passive VPN tunnels.
- B. Configure the remote autonomous system number (ASN) to 4096.
- C. Configure the maximum transmission unit (MTU) to its highest supported value.
- D. Configure a second Cloud Router to scale bandwidth in and out of the VPC.
Answer: A
NEW QUESTION # 69
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection.
Which two actions can accomplish this? (Choose two.)
- A. Run gcloud compute interconnects describe <interconnect>.
- B. Open a Cloud Support ticket under the Cloud Interconnect category.
- C. Check the email for the account of the NOC contact that you specified during the ordering process.
- D. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.
- E. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
Answer: C,E
NEW QUESTION # 70
Refer to the exhibit.
You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):
You need to update the firewall rule to add the following rule to the ruleset:
You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?
- A. Assign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.
- B. Assign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
- C. Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.
- D. Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
Answer: A
NEW QUESTION # 71
You are configuring an HA VPN connection between your Virtual Private Cloud (VPC) and on-premises network. The VPN gateway is named VPN_GATEWAY_1. You need to restrict VPN tunnels created in the project to only connect to your on-premises VPN public IP address: 203.0.113.1/32. What should you do?
- A. Configure an access control list on the peer VPN gateway to deny all traffic except 203.0.113.1/32, and attach it to the primary external interface.
- B. Configure a firewall rule accepting 203.0.113.1/32, and set a target tag equal to VPN_GATEWAY_1.
- C. Configure a Google Cloud Armor security policy, and create a policy rule to allow 203.0.113.1/32.
- D. Configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address.
Answer: D
NEW QUESTION # 72
......
Google Professional-Cloud-Network-Engineer Exam Dumps [2024] Practice Valid Exam Dumps Question: https://www.examtorrent.com/Professional-Cloud-Network-Engineer-valid-vce-dumps.html
Professional-Cloud-Network-Engineer Dumps - Grab Out For [NEW-2024] Google Exam: https://drive.google.com/open?id=17tGq5SVN_hN3TsSexTxyhbuOUcgW1u9d
