Quiz IT certification exam

Question 1

In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subneta.

You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers.

What should you do?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Create network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers. Run the following command:gcloud compute firewall-rules create app-db-firewall-rule \--action allow \--direction ingress \--rules tcp:3306 \--source-ranges 10.128.0.0/20 \--source-tags app-server \--target-tags db-server

Answer

Create network tag app-server and service account sa-db@my-project.iam.gserviceaccount.com.Add the tag to the application servers, and associate the service account with the database servers.Run the following command:gcloud compute firewall-rules create app-db-firewall-rule \--action allow \--direction ingress \--rules top:3306 \--source-tags app-server \--target-service-accounts sa-db@myproject.iam.gserviceaccount.com

Answer

Create service accounts sa-app@my-project.iam.gserviceaccount.com and sa-db@myproject. iam.gserviceaccount.com. Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:gcloud compute firewall-rules create app-db-firewall-ru--allow TCP:3306 \--source-service-accounts sa-app@democloud-idpdemo.iam.gserviceaccount.com \--target-service-accounts sa-db@my-

Answer

Create service accounts sa-app@my-project.iam.gserviceaccount.com and sa-db@myproject. iam.gserviceaccount.com. Associate the service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:gcloud compute firewall-rules create app-db-firewall-ru--allow TCP:3306 \--source-ranges 10.128.0.0/20 \--source-service-accounts sa-app@myproject.iam.gserviceaccount.com \--target-service-accounts sa-db@myproject.iam.gserviceaccount.com

Question 2

You are planning a large application deployment in Google Cloud that includes on-premises connectivity. The application requires direct connectivity between workloads in all regions and onpremises locations without address translation, but all RFC 1918 ranges are already in use in the onpremises locations. What should you do?

Accepted Answer

Use non-RFC 1918 ranges with a single global VPC.

Answer

Use multiple VPC networks with a transit network using VPC Network Peering.

Answer

Use overlapping RFC 1918 ranges with multiple isolated VPC networks.

Answer

Use overlapping RFC 1918 ranges with multiple isolated VPC networks and Cloud NAT.

Question 3

Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only.What should you do?

Accepted Answer

Create an allow on match ingress firewall rule with the target tag "web-server" to allow all IP addresses for TCP ports 80 and 443.

Answer

Create an allow on match ingress firewall rule with the target tag "web-server" to allow all IP addresses for TCP port 80.

Answer

Create an allow on match egress firewall rule with the target tag "web-server" to allow all IP addresses for TCP port 80.

Answer

Create an allow on match egress firewall rule with the target tag "web-server" to allow web server IP addresses for TCP ports 60 and 443.

Question 4

You successfully provisioned a single Dedicated Interconnect. The physical connection is at a colocation facility closest to us-west2. Seventy-five percent of your workloads are in us-east4, and the remaining twenty-five percent of your workloads are in us-central1. All workloads have the same network traffic profile. You need to minimize data transfer costs when deploying VLAN attachments.What should you do?

Accepted Answer

Order a new Dedicated Interconnect for a colocation facility closest to us-east4, and use VPC global routing to access workloads in us-central1.

Answer

Keep the existing Dedicated interconnect. Deploy a VLAN attachment to a Cloud Router in uswest2, and use VPC global routing to access workloads in us-east4 and us-central1.

Answer

Keep the existing Dedicated Interconnect. Deploy a VLAN attachment to a Cloud Router in useast4, and deploy another VLAN attachment to a Cloud Router in us-central1.

Answer

Order a new Dedicated Interconnect for a colocation facility closest to us-central1, and use VPC global routing to access workloads in us-east4.

Question 5

You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?

Accepted Answer

Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC.Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.Configure VPC peering in the spoke VPCs to peer with the hub VPC.

Answer

Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.Associate the zone with the hub VPC. Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke PCs, with the hub VPC as the target.Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.

Answer

Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC.Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.Create a hub-and-spoke VPN deployment in each spoke VPC to connect back to the on-premises network directly.

Answer

Create a private forwarding zone in Cloud DNS for 'corp altostrat.com' called corp-altostrat-com that points to 192. 168.20.88. Associate the zone with the hub VPC.Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.Sat a custom route advertisement on the Cloud Router for 35.199.192.0/19.Create a hub and spoke VPN deployment in each spoke VPC to connect back to the hub VPC.

Question 6

You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC): Google Professional Cloud Network Engineer image Question 126 29235 09182024191348000000

Google Professional Cloud Network Engineer image Question 126 29235 09182024191348000000

You need to update the firewall rule to add the following rule to the ruleset: Google Professional Cloud Network Engineer image Question 126 29235 09182024191348000000

You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?

Accepted Answer

Assign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.

Answer

Assign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.

Answer

Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account.Apply the new firewall rule with a priority of 50.

Answer

Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.

Question 7

Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks. What should you do?

Accepted Answer

Create a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.

Answer

Create an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.

Answer

Create a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.

Answer

Create a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.

Question 8

Your company has provisioned 2000 virtual machines (VMs) in the private subnet of your Virtual Private Cloud (VPC) in the us-east1 region. You need to configure each VM to have a minimum of 128 TCP connections to a public repository so that users can download software updates and packages over the internet. You need to implement a Cloud NAT gateway so that the VMs are able to perform outbound NAT to the internet. You must ensure that all VMs can simultaneously connect to the public repository and download software updates and packages. Which two methods can you use to accomplish this? (Choose two.)

Accepted Answer

Configure the NAT gateway in manual allocation mode, allocate 2 NAT IP addresses, and update the minimum number of ports per VM to 256.

Accepted Answer

Create a second Cloud NAT gateway with the default minimum number of ports configured per VM to 64.

Answer

Use the default Cloud NAT gateway's NAT proxy to dynamically scale using a single NAT IP address.

Answer

Use the default Cloud NAT gateway to automatically scale to the required number of NAT IP addresses, and update the minimum number of ports per VM to 128.

Answer

Configure the NAT gateway in manual allocation mode, allocate 4 NAT IP addresses, and update the minimum number of ports per VM to 128.

Question 9

You have the following routing design. You discover that Compute Engine instances in Subnet-2 in the asia-southeast1 region cannot communicate with compute resources on-premises. What should you do?<img alt="Google Professional Cloud Network Engineer image Question 129 29238 09182024191348000000"   width="558" height="342" src="https://examgecko.com/getfile/e2426332-f530-4b08-8b9a-46c182082a4f">

Accepted Answer

Change the VPC dynamic routing mode to Global.

Answer

Configure a custom route advertisement on the Cloud Router.

Answer

Enable IP forwarding in the asia-southeast1 region.

Answer

Add a second Border Gateway Protocol (BGP) session to the Cloud Router.

Question 10

You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?

Accepted Answer

Create a private zone in Cloud DNS for 'corp altostrat.com' called corp-altostrat-com.Configure DNS Server Policies and create a policy with Alternate DNS servers to 192.168.20.88.Configure your on-premises firewall to accept traffic from 35.199.192.0/19.Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.

Answer

Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.Configure your on-premises firewall to accept traffic from 10.204.0.0/24.Set a custom route advertisement on the Cloud Router for 10.204.0.0/24

Answer

Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168 20.88.Configure your on-premises firewall to accept traffic from 35.199.192.0/19 Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.

Answer

Create a private forwarding zone in Cloud DNS for 'corp .altostrat.com' called corp-altostrat-com that points to 192.168.20.88.Configure your on-premises firewall to accept traffic from 10.204.0.0/24.Modify the /etc/resolv conf file on your Compute Engine instances to point to 192.168.20 88

Question 11

Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with onpremises connectivity already in place. You are deploying a new application using Google Kubernetes Engine (GKE), which must be accessible only from the same VPC network and on-premises locations.You must ensure that the GKE control plane is exposed to a predefined list of on-premises subnets through private connectivity only. What should you do?

Accepted Answer

Create a GKE private cluster with a private endpoint for the control plane. Configure authorized networks to specify the desired on-premises subnets.

Answer

Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.Configure authorized networks to specify the desired on-premises subnets.

Answer

Create a GKE private cluster with a public endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.

Answer

Create a GKE public cluster. Configure authorized networks to specify the desired on-premises subnets.

Question 12

You built a web application with several containerized microservices. You want to run those microservices on Cloud Run. You must also ensure that the services are highly available to your customers with low latency. What should you do?

Accepted Answer

Deploy the Cloud Run services to multiple regions. Create serverless network endpoint groups (NEGs) that point to the services. Create a global HTTPS load balancer, and attach the serverlessNEGs as backend services of the load balancer.

Answer

Deploy the Cloud Run services to multiple availability zones. Create a global TCP load balancer.Add the Cloud Run endpoints to its backend service.

Answer

Deploy the Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTPS load balancer, and attach the Cloud Endpoints to its backend

Answer

Deploy the Cloud Run services to multiple regions. Configure a round-robin A record in Cloud DNS.

Question 13

You have an HA VPN connection with two tunnels running in active/passive mode between your Virtual Private Cloud (VPC) and on-premises network. Traffic over the connection has recently increased from 1 gigabit per second (Gbps) to 4 Gbps, and you notice that packets are being dropped.You need to configure your VPN connection to Google Cloud to support 4 Gbps. What should you do?

Accepted Answer

Configure a second set of active/passive VPN tunnels.

Answer

Configure the remote autonomous system number (ASN) to 4096.

Answer

Configure a second Cloud Router to scale bandwidth in and out of the VPC.

Answer

Configure the maximum transmission unit (MTU) to its highest supported value.

Question 14

You recently deployed two network virtual appliances in us-central1. Your network appliances provide connectivity to your on-premises network, 10.0.0.0/8. You need to configure the routing for your Virtual Private Cloud (VPC). Your design must meet the following requirements:All access to your on-premises network must go through the network virtual appliances.Allow on-premises access in the event of a single network virtual appliance failure.Both network virtual appliances must be used simultaneously.Which method should you use to accomplish this?

Accepted Answer

Configure a network load balancer for the two network virtual appliances. Configure a route for 10.0.0.0/8 with the network load balancer as the next hop.

Answer

Configure two routes for 10.0.0.0/8 with different priorities, each pointing to separate network virtual appliances.

Answer

Configure an internal HTTP(S) load balancer with the two network virtual appliances as backends.Configure a route for 10.0.0.0/8 with the internal HTTP(S) load balancer as the next hop.

Answer

Configure an internal TCP/UDP load balancer with the two network virtual appliances as backends.Configure a route for 10.0.0.0/8 with the internal load balancer as the next hop.

Question 15

You are responsible for enabling Private Google Access for the virtual machine (VM) instances in your Virtual Private Cloud (VPC) to access Google APIs. All VM instances have only a private IP address and need to access Cloud Storage.You need to ensure that all VM traffic is routed back to your onpremises data center for traffic scrubbing via your existing Cloud Interconnect connection. However, VM traffic to Google APIs should remain in the VPC. What should you do?

Accepted Answer

Configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP) with a lower priority (MED) than the default VPC route.Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to private googleapis com, and create an A record for private.googleapis.com that resolves to the addresses in 199 .36.153.8/30.Create a static route in your VPC for the range 199.36. 153.8/30 with the default internet gateway as the next hop.

Answer

Delete the default route in your VPC.Create a private Cloud DNS zone for googleapis.com, create a CNAME for *.googleapis.com to restricted googleapis.com, and create an A record for restricted googleapis com that resolves to the addresses in 199.36.153.4/30.Create a static route in your VPC for the range 199.36.153.4/30 with the default internet gateway as the next hop.

Answer

Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP).Create a public Cloud DNS zone with a CNAME for *.google.com to private googleapis com, create a CNAME for * googleapis.com to private googleapis com, and create an A record for Private googleapis.com that resolves to the addresses in 199.36.153 8/30.Create a static route in your VPC for the range 199 .36.153.8/30 with the default internet gateway as the next hop.

Answer

Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP).Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to Private googleapis.com, and create an A record for private.googleapis.com that resolves to the addresses in 199.36.153.8/30.Create a static route in your VPC for the range 199.36.153.8/30 with the default internet gateway as the next hop.

Question 16

You are designing a hub-and-spoke network architecture for your company's cloud-based environment. You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access.The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5. What should you do?

Accepted Answer

Create a default route in the hub VPC that points to IP address 10.0.0.5.Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.Export the custom routes in the hub. Import the custom routes in the spokes.Delete the default internet gateway route of the spokes.

Answer

Create a default route in the hub VPC that points to IP address 10.0.0.5.Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.Export the custom routes in the hub.Import the custom routes in the spokes.

Answer

Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances.Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.Export the custom routes in the hub. Import the custom routes in the spokes.

Answer

Create a default route in the hub VPC that points to IP address 10.0.0.5.Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.Create a new route in the spoke VPC that points to IP address 10.0.0.5.

Question 17

You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the onpremises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel.Which filter should you use in Cloud Logging to examine the logs?

Accepted Answer

resource.type= "vpn_tunnel"

Answer

resource.type= "gce_router"

Answer

resource.type= "gce_network_region"

Answer

resource.type= "vpn_gateway"

Question 18

Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from on-premises locations using Cloud Interconnect connections. Your company must be able to send traffic to Cloud Storage only through the Interconnect links while accessing other Google APIs and services over the public internet. What should you do?

Accepted Answer

Use Private Service Connect to access Cloud Storage, and use the default public domains for all other Google APIs and services.

Answer

Use the default public domains for all Google APIs and services.

Answer

Use Private Google Access, with restricted.googleapis.com virtual IP addresses for Cloud Storage and private.googleapis.com for all other Google APIs and services.

Answer

Use Private Google Access, with private.googleapis.com virtual IP addresses for Cloud Storage and restricted.googleapis.com virtual IP addresses for all other Google APIs and services.

Question 19

Your organization has a Google Cloud Virtual Private Cloud (VPC) with subnets in us-east1, us-west4, and europe-west4 that use the default VPC configuration. Employees in a branch office in Europe need to access the resources in the VPC using HA VPN. You configured the HA VPN associated with the Google Cloud VPC for your organization with a Cloud Router deployed in europe-west4. You need to ensure that the users in the branch office can quickly and easily access all resources in the VPC.What should you do?

Accepted Answer

Configure the VPC dynamic routing mode to Global.

Answer

Create custom advertised routes for each subnet.

Answer

Configure each subnet's VPN connections to use Cloud VPN to connect to the branch office.

Answer

Set the advertised routes to Global for the Cloud Router.

Question 20

Your organization uses a Shared VPC architecture with a host project and three service projects. You have Compute Engine instances that reside in the service projects. You have critical workloads in your on-premises data center. You need to ensure that the Google Cloud instances can resolve onpremises hostnames via the Dedicated Interconnect you deployed to establish hybrid connectivity.What should you do?

Accepted Answer

Configure a Cloud DNS private zone in the host project of the Shared VPC.Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project.Configure a DNS policy in the Shared VPC to allow inbound query forwarding with your on-premises DNS server as the alternative DNS server.

Answer

Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the private zone to the on-premises DNS servers.In your Cloud Router, add a custom route advertisement for the IP 35.199.192.0/19 to the onpremises environment.

Answer

Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the Private zone to the on-premises DNS servers.In your Cloud Router, add a custom route advertisement for the IP 169.254 169.254 to the onpremises environment.

Answer

Configure a Cloud DNS private zone in the host project of the Shared VPC.Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project In your Cloud Router, add a custom route advertisement for the IP 169.254 169 254 to the onpremises environment.

Question 21

Your organization is implementing a new security policy to control how firewall rules are applied to control flows between virtual machines (VMs). Using Google-recommended practices, you need to set up a firewall rule to enforce strict control of traffic between VM A and VM B. You must ensure that communications flow only from VM A to VM B within the VPC, and no other communication paths are allowed. No other firewall rules exist in the VPC. Which firewall rule should you configure to allow only this communication path?

Accepted Answer

Firewall rule direction: ingressAction: allowTarget: specific VM A tagSource ranges: VM B tag and VM B source IP addressPriority: 100

Answer

Firewall rule direction: ingressAction: allowTarget: VM B service accountSource ranges: VM A service accountPriority: 1000

Answer

Firewall rule direction: ingressAction: allowTarget: specific VM B tagSource ranges: VM A tag and VM A source IP addressPriority: 1000

Answer

Firewall rule direction: ingressAction: allowTarget: VM A service accountSource ranges: VM B service account and VM B source IP addressPriority: 100

Question 22

You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision. What should you do?

Accepted Answer

Use Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.

Answer

Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.

Answer

Configure VPC Flow Logs. Review the logs by filtering on the source and destination.

Answer

Configure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.

Question 23

You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1and us-east1. You want to serve the content with the lowest-possible latency while ensuring highavailability and autoscaling, and create native content-based rules using the HTTP hostname andrequest path. The IP addresses of the clients that connect to the load balancer need to be visible tothe backends. Which configuration should you use?

Accepted Answer

Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header

Answer

Use Network Load Balancing

Answer

Use TCP Proxy Load Balancing with PROXY protocol enabled

Answer

Use External HTTP(S) Load Balancing with URL Maps and custom headers

Question 24

You need to define an address plan for a future new Google Kubernetes Engine (GKE) cluster in your Virtual Private Cloud (VPC). This will be a VPC-native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses. Which subnet mask should you use for the Pod IP address range?

Accepted Answer

/21

Answer

/22

Answer

/23

Answer

/25

Question 25

You are responsible for designing a new connectivity solution for your organization's enterprise network to access and use Google Workspace. You have an existing Shared VPC with Compute Engine instances in us-west1. Currently, you access Google Workspace via your service provider's internet access. You want to set up a direct connection between your network and Google. What should you do?

Accepted Answer

Order a Direct Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.

Answer

Order a Dedicated Interconnect connection in the same metropolitan area. Create a VLAN attachment, a Cloud Router in us-west1, and a Border Gateway Protocol (BGP) session between your Cloud Router and your router.

Answer

Configure HA VPN in us-west1. Configure a Border Gateway Protocol (BGP) session between your Cloud Router and your on-premises data center.

Answer

Order a Carrier Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.

Question 26

You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?

Accepted Answer

Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.

Answer

Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.

Answer

Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.

Answer

Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.

Question 27

You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules.Always allow Secure Shell (SSH) from your corporate IP address.Restrict SSH access from all other IP addresses.There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team's requirements. What should you do?

Accepted Answer

Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0.Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1.

Answer

Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0.Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1.

Answer

Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1.Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0.

Answer

Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1 Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.

Question 28

You are designing a new application that has backends internally exposed on port 800. The application will be exposed externally using both IPv4 and IPv6 via TCP on port 700. You want to ensure high availability for this application. What should you do?

Accepted Answer

Create a TCP proxy that uses backend services containing an instance group with two instances.

Answer

Create a network load balancer that used backend services containing one instance group with two instances.

Answer

Create a network load balancer that uses a target pool backend with two instances.

Answer

Create a TCP proxy that uses a zonal network endpoint group containing one instance.

Question 29

You work for a university that is migrating to Google Cloud.These are the cloud requirements:On-premises connectivity with 10 GbpsLowest latency access to the cloudCentralized Networking Administration TeamNew departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.What should you do?

Accepted Answer

Use Shared VPC, and deploy the VLAN attachments and Dedicated Interconnect in the host project.

Answer

Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.

Answer

Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Dedicated Interconnects.

Answer

Use standalone projects and deploy the VLAN attachments and Dedicated Interconnects in each of the individual projects.

Question 30

You have several microservices running in a private subnet in an existing Virtual Private Cloud (VPC).You need to create additional serverless services that use Cloud Run and Cloud Functions to access the microservices. The network traffic volume between your serverless services and private microservices is low. However, each serverless service must be able to communicate with any of your microservices. You want to implement a solution that minimizes cost. What should you do?

Accepted Answer

Create a serverless VPC access connector. Configure the serverless service to use the connector for communication to the microservices.

Answer

Deploy your serverless services to the serverless VPC. Peer the serverless service VPC to the existing VPC. Configure firewall rules to allow traffic between the serverless services and your existing microservices.

Answer

Create a serverless VPC access connector for each serverless service. Configure the connectors to allow traffic between the serverless services and your existing microservices.

Answer

Deploy your serverless services to the existing VPC. Configure firewall rules to allow traffic between the serverless services and your existing microservices.

Question 31

You have provisioned a Dedicated Interconnect connection of 20 Gbps with a VLAN attachment of 10 Gbps. You recently noticed a steady increase in ingress traffic on the Interconnect connection from the on-premises data center. You need to ensure that your end users can achieve the full 20 Gbps throughput as quickly as possible. Which two methods can you use to accomplish this? (Choose two.)

Accepted Answer

From the Google Cloud Console, modify the bandwidth of the VLAN attachment to 20 Gbps.

Accepted Answer

Configure Link Aggregation Control Protocol (LACP) on the on-premises router to use the 20-Gbps Dedicated Interconnect connection.

Answer

Configure an additional VLAN attachment of 10 Gbps in another region. Configure the on-premises router to advertise routes with the same multi-exit discriminator (MED).

Answer

Configure an additional VLAN attachment of 10 Gbps in the same region. Configure the onpremises router to advertise routes with the same multi-exit discriminator (MED).

Answer

From the Google Cloud Console, request a new Dedicated Interconnect connection of 20 Gbps, and configure a VLAN attachment of 10 Gbps.

Question 32

Your company has a Virtual Private Cloud (VPC) with two Dedicated Interconnect connections in two different regions: us-west1 and us-east1. Each Dedicated Interconnect connection is attached to a Cloud Router in its respective region by a VLAN attachment. You need to configure a high availability failover path. By default, all ingress traffic from the on-premises environment should flow to the VPC using the us-west1 connection. If us-west1 is unavailable, you want traffic to be rerouted to us-east1.How should you configure the multi-exit discriminator (MED) values to enable this failover path?

Accepted Answer

Use regional routing. Set the us-east1 Cloud Router to a base priority of 100, and set the us-west1 Cloud Router to a base priority of 1

Answer

Use global routing. Set the us-east1 Cloud Router to a base priority of 100, and set the us-west1 Cloud Router to a base priority of 1

Answer

Use regional routing. Set the us-east1 Cloud Router to a base priority of 1000, and set the uswest1 Cloud Router to a base priority of 1

Answer

Use global routing. Set the us-east1 Cloud Router to a base priority of 1000, and set the us-west1 Cloud Router to a base priority of 1

Question 33

You have the following private Google Kubernetes Engine (GKE) cluster deployment:<img alt="Google Professional Cloud Network Engineer image Question 153 29262 09182024191348000000"   width="570" height="537" src="https://examgecko.com/getfile/52ad475d-ea6d-4ef8-959e-96b16d34b76f">You have a virtual machine (VM) deployed in the same VPC in the subnetwork kubernetesmanagement with internal IP address 192.168.40 2/24 and no external IP address assigned. You need to communicate with the cluster master using kubectl. What should you do?

Accepted Answer

Add the network 192.168.40.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2.

Answer

Add the network 192.168.38.0/28 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2

Answer

Add the network 192.168.36.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2

Answer

Add an external IP address to the VM, and add this IP address in the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 35.224.37.17.

Question 34

You have the networking configuration shown In the diagram Two VLAN attachments associated With two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BOP) sessions associated With each Of the VLAN attachments.You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?<img alt="Google Professional Cloud Network Engineer image Question 154 29263 09182024191348000000"   width="927" height="389" src="https://examgecko.com/getfile/b832fac2-dde5-45de-b274-9e5e7e9051a1">

Accepted Answer

From the Google Cloud console, navigate to the Hybrid Connectivity select the Cloud Router, and view BGP sessions.

Answer

From the Cloud CLI, run gcloud compute --protect_ID router get---status mycloudrouter ----region REGION and review the results.

Answer

From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results

Answer

From the Cloud CLI. run gcloud compute routers describe mycloudrouter --region REGION and review the results

Question 35

You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) Instances What two prerequisite tasks must be completed before creating the load balancer?Choose 2 answers

Accepted Answer

Create firewall rules for health checks

Accepted Answer

Reserve a static IP address for the load balancer

Answer

Choose a region.

Answer

Determine the subnet mask for a proxy-only subnet.

Answer

Determine the subnet mask for Serverless VPC Access.

Question 36

You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket, You are using the VSE ORIG.-X_NZADERS cache mode You receive an HTTP 403 error when opening the file In your browser and you see that the HTTP response has a Cache-control: private, max-age=O header How should you correct this Issue?

Accepted Answer

Configure a Cloud Storage bucket permission that gives the Storage Legacy Object Reader role

Answer

Change the cache mode to cache all content.

Answer

Increase the default time-to-live (TTL) for the backend service.

Answer

Enable negative caching for the backend bucket

Question 37

You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer You must ensure that your application meets the following requirements* Maps multiple existing reserved external IP addresses to the Instance* Processes IP Encapsulating Security Payload (ESP) trafficWhat should you do?

Accepted Answer

Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.

Answer

Configure a target pool, and create protocol forwarding rules for each external IP address.

Answer

Configure a backend service, and create an external network load balancer for each external IP address

Answer

Configure the Compute Engine Instances' network Interface external IP address from None to Ephemeral Add as many external IP addresses as required

Question 38

You are planning to use Terraform to deploy the Google Cloud infrastructure for your company The design must meet the following requirements* Each Google Cloud project must represent an Internal project that your team Will work on* After an internal project is finished, the infrastructure must be deleted* Each Internal project must have Its own Google Cloud project owner to manage the Google Cloud resources-* You have 10-100 projects deployed at a time,While you are writing the Terraform code, you need to ensure that the deployment IS Simple, and the code IS reusable With centralized management What should you doo

Accepted Answer

Create a single Shared VPC and attach each Google Cloud project as a service project

Answer

Create a Single pt0Ject and additional VPCs for each Internal project

Answer

Create a Single Project and Single VPC for each internal project

Answer

Create a Shared VPC and service project for each Internal project

Question 39

Your company recently migrated to Google Cloud in a Single region. You configured separate Virtual Private Cloud (VPC) networks for two departments. Department A and Department B. Department A has requested access to resources that are part Of Department Bis VPC. You need to configure the traffic from private IP addresses to flow between the VPCs using multi-NIC virtual machines (VMS) to meet security requirements Your configuration also must* Support both TCP and UDP protocols* Provide fully automated failover* Include health-checksRequire minimal manual Intervention In the client VMSWhich approach should you take?

Accepted Answer

Create an instance template and a managed instance group. Configure two separate internal TCP/IJDP load balancers for each protocol (TCP!UDP), and configure the client VIVIS to use the internal load balancers' virtual IP addresses

Answer

Create the VMS In the same zone, and configure static routes With IP addresses as next hops.

Answer

Create the VMS in different zones, and configure static routes with instance names as next hops

Answer

Create an Instance template and a managed instance group. Configure a Single internal load balancer, and define a custom static route with the Internal TCP/UDP load balancer as the next hop

Question 40

Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node Which Pod per node CIDR range should you use?

Accepted Answer

/25

Answer

/24

Answer

/26

Answer

/28

Google Professional Cloud Network Engineer Practice Test 4

Google Professional Cloud Network Engineer Practice Tests