Professional-Cloud-Network-Engineer Dumps PDF 2024 Strategy Your Preparation Efficiently
Latest Verified & Correct Google Professional-Cloud-Network-Engineer Questions
NEW QUESTION # 81
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users.
What should you do?
- A. Create a Cloud Armor Policy rule that denies traffic and review necessary logs.
- B. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to disabled, and review necessary logs.
- C. Create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
- D. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to enabled, and review necessary logs.
Answer: C
Explanation:
https://cloud.google.com/armor/docs/security-policy-concepts#preview_mode
NEW QUESTION # 82
You need to create the network infrastructure to deploy a highly available web application in the us-east1 and us-west1 regions.
The application runs on Compute Engine instances, and it does not require the use of a database. You want to follow Google-recommended practices. What should you do?
- A. Create one VPC in each region, and peer both VPCs.
Create a global load balancer.
Enable Cloud CDN on the load balancer.
Create a CNAME for the load balancer in Cloud DNS. - B. Create one VPC with one subnet in each region.
Create an HTTP(S) load balancer with a static IP address.
Choose the standard tier for the network.
Enable Cloud CDN on the load balancer.
Create a CNAME record using the load balancer's IP address in Cloud DNS. - C. Create one VPC with one subnet in each region.
Create a global load balancer with a static IP address.
Enable Cloud CDN and Google Cloud Armor on the load balancer.
Create an A record using the IP address of the load balancer in Cloud DNS. - D. Create one VPC with one subnet in each region.
Create a regional network load balancer in each region with a static IP address.
Enable Cloud CDN on the load balancers.
Create an A record in Cloud DNS with both IP addresses for the load balancers.
Answer: A
NEW QUESTION # 83
You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicy permission, and try again.
- B. Add the resourcemanager.projects.get permission, and try again.
- C. Try again with a different role with a new name but the same permissions.
- D. Remove the resourcemanager.projects.list permission, and try again.
Answer: D
NEW QUESTION # 84
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. Client IP and protocol
- B. None
- C. Client IP
- D. Client IP, port and protocol
Answer: C
NEW QUESTION # 85
You need to configure the Border Gateway Protocol (BGP) session for a VPN tunnel you just created between two Google Cloud VPCs, 10.1.0.0/16 and 172.16.0.0/16. You have a Cloud Router (router-1) in the 10.1.0.0/16 network and a second Cloud Router (router-2) in the 172.16.0.0/16 network. Which configuration should you use for the BGP session?
- A.
- B.
- C.
- D.
Answer: D
NEW QUESTION # 86
You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6 virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest-possible latency while ensuring high availability and autoscaling, and create native content-based rules using the HTTP hostname and request path. The IP addresses of the clients that connect to the load balancer need to be visible to the backends. Which configuration should you use?
- A. Use Network Load Balancing
- B. Use External HTTP(S) Load Balancing with URL Maps and custom headers
- C. Use TCP Proxy Load Balancing with PROXY protocol enabled
- D. Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header
Answer: D
NEW QUESTION # 87
You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)
- A. Turn on Private Google Access at the VPC level.
- B. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
- C. Turn on Private Google Access at the subnet level.
- D. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
- E. Turn on Private Services Access at the VPC level.
Answer: B,E
NEW QUESTION # 88
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the private attribute.
- B. Ensure that the object you don't want to be cached anymore is not shared publicly.
- C. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
- D. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
Answer: C
Explanation:
https://cloud.google.com/cdn/docs/invalidating-cached-content
NEW QUESTION # 89
You work for a university that is migrating to Google Cloud.
These are the cloud requirements:
On-premises connectivity with 10 Gbps
Lowest latency access to the cloud
Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
- B. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Dedicated Interconnects.
- C. Use Shared VPC, and deploy the VLAN attachments and Dedicated Interconnect in the host project.
- D. Use standalone projects and deploy the VLAN attachments and Dedicated Interconnects in each of the individual projects.
Answer: C
NEW QUESTION # 90
You are creating an instance group and need to create a new health check for HTTP(s) load balancing.
Which two methods can you use to accomplish this? (Choose two.)
- A. Create a new health check using the VPC Network section in the GCP Console.
- B. Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the GCP Console.
- C. Create a new health check using the gcloud command line tool.
- D. Create a new legacy health check using the Health checks section in the GCP Console.
- E. Create a new legacy health check using the gcloud command line tool.
Answer: B,C
Explanation:
https://cloud.google.com/load-balancing/docs/health-checks#creating_and_modifying_health_checks
NEW QUESTION # 91
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security?
(Choose two.)
- A. Shared VPC
- B. Cloud VPN
- C. Dedicated Interconnect
- D. Cloud NAT
- E. VPC peering
Answer: B,C
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/vpc
NEW QUESTION # 92
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
GetIamPolicy() via REST API
- A. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --
- B. role roles/editor
- C. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
- D. setIamPolicy() via REST API
- E. role roles/editor
gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --
Answer: B,C
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/granting-changing-revoking-access
NEW QUESTION # 93
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?
- A. Configure VPC peering in a full mesh.
- B. Create network tags to allow connectivity between all three VPCs.
- C. Alter the routing table to resolve the asymmetric route.
- D. Delete the legacy network and recreate it to allow transitive peering.
Answer: A
NEW QUESTION # 94
Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node Which Pod per node CIDR range should you use?
- A. /24
- B. /28
- C. /26
- D. /25
Answer: D
Explanation:
To determine the Pod per node CIDR range, you need to calculate how many IP addresses are required for each node, and then choose the smallest CIDR range that can accommodate that number. A CIDR range of /n means that there are 2^(32-n) IP addresses available in that range. For example, a /24 range has 2^(32-24) = 256 IP addresses.
According to the question, the application team requires a minimum of 60 Pods per node and a maximum of 100 Pods per node. Therefore, you need to choose a CIDR range that can provide at least 100 IP addresses per node, but not more than necessary. A /25 range has 2^(32-25) = 128 IP addresses, which is enough for 100 Pods per node. A /26 range has 2^(32-26) = 64 IP addresses, which is not enough for 60 Pods per node. A /24 range has 256 IP addresses, which is more than needed and wastes IP address space. A /28 range has 2^(32-28) = 16 IP addresses, which is far too small for any node.
Therefore, the best option is B. /25. This is also consistent with the Google Kubernetes Engine documentation, which states that each node is allocated a /24 range of IP addresses for Pods by default, but the maximum number of Pods per node is 1101. This means that there are approximately twice as many available IP addresses as possible Pods, which is similar to the ratio of 128 to 100 in the /25 range.
1: Configure maximum Pods per node | Google Kubernetes Engine (GKE) | Google Cloud
NEW QUESTION # 95
You want to configure a NAT to perform address translation between your on-premises network blocks and GCP.
Which NAT solution should you use?
- A. An instance configured with iptables DNAT rules
- B. Cloud NAT
- C. An instance with IP forwarding enabled
- D. An instance configured with iptables SNAT rules
Answer: B
NEW QUESTION # 96
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command.
Which next hop should you choose?
- A. The IP address of the instance on the remote side of the VPN tunnel
- B. The IP address of the Cloud VPN gateway
- C. The name and region of the Cloud VPN tunnel
- D. The default internet gateway
Answer: C
Explanation:
When you create a route based tunnel using the Cloud Console, Classic VPN performs both of the following tasks: Sets the tunnel's local and remote traffic selectors to any IP address (0.0.0.0/0) For each range in Remote network IP ranges, Google Cloud creates a custom static route whose destination (prefix) is the range's CIDR, and whose next hop is the tunnel. https://cloud.google.com/network-connectivity/docs/vpn/how-to/creating-static-vpns
NEW QUESTION # 97
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
- B. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- C. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- D. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION # 98
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?
- A. Enable logging on the default Deny Any Firewall Rule.
- B. Enable logging on the VM Instances that receive traffic.
- C. Create an explicit Deny Any rule and enable logging on the new rule.
- D. Create a logging sink forwarding all firewall logs with no filters.
Answer: B
NEW QUESTION # 99
You have created several preemptible Linux virtual machine instances using Google Compute Engine. You want to properly shut down your application before the virtual machines are preempted. What should you do?
- A. Create a shutdown script registered as a xinetd service in Linux and configure a StackDriver endpoint check to call the service.
- B. Create a shutdown script named shutdown in the /etc/ directory.
- C. Create a shutdown script and use it as the value for a new metadata entry with the key shutdown- script in the Cloud Platform Console when you create the new virtual machine instance.
- D. Create a shutdown script, registered as a xinetd service in Linux, and use the gcloud compute instances add-metadata command to specify the service URL as the value for a new metadata entry with the key shutdown-script-url
Answer: C
Explanation:
Running Shutdown Scripts "Create and run shutdown scripts that execute commands right before an instance is terminated or restarted, on a best-effort basis. This is useful if you rely on automated scripts to start up and shut down instances, allowing instances time to clean up or perform tasks, such as exporting logs, or syncing with other systems."
https://cloud.google.com/compute/docs/shutdownscript
To setup Shutdown Scripts, go to GCP console and follow the steps:
Compute Engine -> VM instance -> Create Instance -> (Expand) Management, disks, networking, SSH keys Enter the key "shutdown-script" and proper value
NEW QUESTION # 100
You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours.
Which connectivity method should you choose?
- A. Dedicated Interconnect, but don't provision any VLAN attachments
- B. Cloud VPN
- C. Dedicated Interconnect with a single VLAN attachment
- D. 50-Mbps Partner VLAN attachment
Answer: B
NEW QUESTION # 101
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
- A. gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
- B. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
- C. GetIamPolicy() via REST API
- D. setIamPolicy() via REST API
- E. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername -- role roles/editor
Answer: A,B
Explanation:
https://cloud.google.com/iam/docs/granting-changing-revoking-access
NEW QUESTION # 102
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Ingress
- B. GKE Cluster
- C. GKE Pod
- D. GKE Node
Answer: C
Explanation:
https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig
NEW QUESTION # 103
You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider.
Which connection type should you choose?
- A. Dedicated Interconnect
- B. Partner Interconnect
- C. Direct Peering
- D. Carrier Peering
Answer: C
Explanation:
When established, Direct Peering provides a direct path from your on-premises network to Google services, including Google Cloud products that can be exposed through one or more public IP addresses. Traffic from Google's network to your on-premises network also takes that direct path, including traffic from VPC networks in your projects. Google Cloud customers must request that direct egress pricing be enabled for each of their projects after they have established Direct Peering with Google. For more information, see Pricing.
NEW QUESTION # 104
You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses.
Which subnet mask should you use for the Pod IP address range?
- A. /22
- B. /23
- C. /25
- D. /21
Answer: C
Explanation:
Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips
NEW QUESTION # 105
You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Igal and int-Iga2) terminate on the same Cloud Router The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. If the active Interconnect connection fails, you want the passive Interconnect connection to automatically begin routing all traffic Which two actions should you take to meet this requirement? (Choose Two)
- A. Advertise a lower MED on the passive Interconnect connection from the on-premises router
- B. Advertise a lower MED on the active Interconnect connection from the on-premises router
- C. Configure the advertised route priority as 200 for the BGP session associated With the passive Interconnect connection.
- D. Configure the advertised route priority > 10,200 on the active Interconnect connection.
- E. Configure the advertised route priority as 200 for the BGP session associated Wlth the active Interconnect connection.
Answer: B,E
Explanation:
This answer meets the requirement of configuring one connection as Active for both ingress and egress traffic, and enabling automatic failover to the passive connection in case of failure. The reason is:
The advertised route priority is a value that Cloud Router uses to set the route priority when advertising routes to your on-premises router. The lower the value, the higher the priority1. By setting the advertised route priority as 200 for the active connection, you ensure that it has a higher priority than the passive connection, which has the default value of 1001. This way, your on-premises router will prefer the routes from the active connection over the passive one for ingress traffic.
The MED (Multi-Exit Discriminator) is a value that your on-premises router uses to indicate its preference for receiving traffic from Cloud Router. The lower the value, the higher the preference2. By advertising a lower MED on the active connection from your on-premises router, you ensure that Cloud Router will prefer sending traffic to the active connection over the passive one for egress traffic.
If the active connection fails, Cloud Router will stop receiving routes from it and will start using the routes from the passive connection for egress traffic. Similarly, your on-premises router will stop receiving routes with priority 200 from the active connection and will start using the routes with priority 100 from the passive connection for ingress traffic. This achieves automatic failover without any manual intervention.
Option A is incorrect because setting the advertised route priority > 10,200 on the active connection would deprioritize it globally in your VPC network, which is not what you want1. Option B is incorrect because advertising a lower MED on the passive connection would make Cloud Router prefer sending traffic to it over the active one, which is not what you want2. Option D is incorrect because setting the advertised route priority as 200 for both connections would make them equally preferred by your on-premises router, which is not what you want1.
Reference:
Update the base route priority | Cloud Router | Google Cloud
Configuring BGP sessions | Cloud Router | Google Cloud
NEW QUESTION # 106
......
Professional-Cloud-Network-Engineer PDF Dumps Are Helpful To produce Your Dreams Correct QA's: https://www.exam4pdf.com/Professional-Cloud-Network-Engineer-dumps-torrent.html
100% Pass Guaranteed Download Google Cloud Platform Exam PDF Q&A: https://drive.google.com/open?id=1QvYwAbtzNBJ6D63vI34QlECaQZkhw0z-
