[Nov-2021] Pass Google Professional-Cloud-Network-Engineer Exam in First Attempt Guaranteed!
Full Professional-Cloud-Network-Engineer Practice Test and 80 unique questions with explanations waiting just for you, get it now!
NEW QUESTION 45
Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances.
Which two products should you incorporate into the solution? (Choose two.)
- A. Compute Engine instance system logs
- B. Firewall logs
- C. Stackdriver Trace
- D. VPC flow logs
- E. Cloud Audit logs
Answer: B,D
Explanation:
A: Using VPC Flow Logs VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes. These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization. https://cloud.google.com/vpc/docs/using-flow-logs (B): Firewall Rules Logging overview Firewall Rules Logging allows you to audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Firewall Rules Logging is also useful if you need to determine how many connections are affected by a given firewall rule. You enable Firewall Rules Logging individually for each firewall rule whose connections you need to log. Firewall Rules Logging is an option for any firewall rule, regardless of the action (allow or deny) or direction (ingress or egress) of the rule. https://cloud.google.com/vpc/docs/firewall-rules-logging
NEW QUESTION 46
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?
- A. Enable logging on the VM Instances that receive traffic.
- B. Create an explicit Deny Any rule and enable logging on the new rule.
- C. Create a logging sink forwarding all firewall logs with no filters.
- D. Enable logging on the default Deny Any Firewall Rule.
Answer: A
NEW QUESTION 47
You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload.
Which type of load balancer should you use?
- A. Internal load balancer
- B. TCP/SSL proxy load balancer
- C. Network load balancer
- D. HTTP(S) load balancer
Answer: B
Explanation:
By default TCP/SSL proxy load balancer original client IP address and port information is not preserved, but it can be preserved using the PROXY protocol: https://cloud.google.com/load-balancing/docs/tcp#target-proxies
https://medium.com/google-cloud/preserving-client-ips-through-google-clouds-global-tcp-and-ssl-proxy-load-balancers-3697d76feeb1
NEW QUESTION 48
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
* Your ISP is a Google Partner Interconnect provider.
* Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.
* A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses.
* Most of the data transfer will be from GCP to the on-premises environment.
* The application can burst up to 1.5 Gbps during peak transfers over the Interconnect.
* Cost and the complexity of the solution should be minimal.
How should you provision the connectivity solution?
- A. Provision a Partner Interconnect through your ISP.
- B. Use network compression over your VPN to increase the amount of data you can send over your VPN.
- C. Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
- D. Provision a Dedicated Interconnect instead of a VPN.
Answer: C
NEW QUESTION 49
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure a global load balancer with the designated IPv6 address.
- B. Create the instance with the designated IPv6 address.
- C. Configure a TCP Proxy with the designated IPv6 address.
- D. Configure an internal load balancer with the designated IPv6 address.
Answer: A
Explanation:
https://cloud.google.com/load-balancing/docs/ipv6
NEW QUESTION 50
You want to configure a NAT to perform address translation between your on-premises network blocks and GCP.
Which NAT solution should you use?
- A. An instance configured with iptables SNAT rules
- B. An instance configured with iptables DNAT rules
- C. An instance with IP forwarding enabled
- D. Cloud NAT
Answer: D
NEW QUESTION 51
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:
* IP ranges for pods and services must be as small as possible.
* The nodes and the master must not be reachable from the internet.
* You must be able to use kubectl commands from on-premises subnets to manage the cluster.
How should you create the GKE cluster?
- A. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable privateEndpoint on the cluster master.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - B. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable a GKE cluster network policy, set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - C. * Create a VPC-native GKE cluster using GKE-managed IP ranges.
* Set the pod IP range as /21 and service IP range as /24.
* Set up a network proxy to access the master. - D. * Create a private cluster that uses VPC advanced routes.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
Answer: B
Explanation:
Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips
NEW QUESTION 52
You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicy permission, and try again.
- B. Add the resourcemanager.projects.get permission, and try again.
- C. Try again with a different role with a new name but the same permissions.
- D. Remove the resourcemanager.projects.list permission, and try again.
Answer: D
Explanation:
Reference:
https://cloud.google.com/iam/docs/understanding-custom-roles
NEW QUESTION 53
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- B. Tune TCP parameters on the on-premises servers.
- C. Compress files using utilities like tar to reduce the size of data being sent.
- D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
Answer: D
NEW QUESTION 54
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?
- A. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
- B. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
- C. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
- D. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
Answer: C
Explanation:
VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.
Reference: https://cloud.google.com/vpc/docs/vpc-peering
NEW QUESTION 55
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts.
You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. Client IP, port and protocol
- B. None
- C. Client IP and protocol
- D. Client IP
Answer: D
NEW QUESTION 56
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- B. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- C. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
- D. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
Answer: C
Explanation:
https://cloud.google.com/sdk/gcloud/reference/dns/record-sets/import
NEW QUESTION 57
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. SSL proxy load balancer
- B. TCP proxy load balancer
- C. HTTPS load balancer
- D. Network load balancer
Answer: B
Explanation:
https://cloud.google.com/security/encryption-in-transit/ Automatic encryption between GFEs and backends For the following load balancer types, Google automatically encrypts traffic between Google Front Ends (GFEs) and your backends that reside within Google Cloud VPC networks: HTTP(S) Load Balancing TCP Proxy Load Balancing SSL Proxy Load Balancing
NEW QUESTION 58
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure a TCP Proxy with the designated IPv6 address.
- B. Create the instance with the designated IPv6 address.
- C. Configure a global load balancer with the designated IPv6 address.
- D. Configure an internal load balancer with the designated IPv6 address.
Answer: A
NEW QUESTION 59
You work for a university that is migrating to GCP.
These are the cloud requirements:
* On-premises connectivity with 10 Gbps
* Lowest latency access to the cloud
* Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
- B. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- C. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
- D. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
Answer: B
Explanation:
https://cloud.google.com/interconnect/docs/how-to/dedicated/using-interconnects-other-projects Using Cloud Interconnect with Shared VPC You can use Shared VPC to share your VLAN attachment in a project with other VPC networks. Choosing Shared VPC is preferable if you need to create many projects and would like to prevent individual project owners from managing their connectivity back to your on-premises network. In this scenario, the host project contains a common Shared VPC network usable by VMs in service projects. Because VMs in the service projects use this network, Service Project Admins don't need to create other VLAN attachments or Cloud Routers in the service projects. In this scenario, you must create VLAN attachments and Cloud Routers for a Cloud Interconnect connection only in the Shared VPC host project. The combination of a VLAN attachment and its associated Cloud Router are unique to a given Shared VPC network. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/enabling-multiple-networks-access-same-attachment#using_with
https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 60
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
- B. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the private attribute.
- C. Ensure that the object you don't want to be cached anymore is not shared publicly.
- D. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
Answer: C
Explanation:
Reference:
https://developers.google.com/web/ilt/pwa/caching-files-with-service-worker
NEW QUESTION 61
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost.
Which two steps should you take? (Choose two.)
- A. Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
- B. Enable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-dev) a service project.
- C. Connect the VPCs in project code-dev and data-dev using VPC Network Peering.
- D. Create a route in the code-dev project to the destination prefixes in project data-dev and use nexthop as the default gateway, and vice versa.
- E. Connect both projects using Cloud VPN.
Answer: B,D
NEW QUESTION 62
......
Prepare for your Google certification with the updated Fast2test Professional-Cloud-Network-Engineer exam questions: https://drive.google.com/open?id=1RjWddhLuUU9NZiyBONFfzAlJ0w-xp96c
Get Latest Professional-Cloud-Network-Engineer Dumps Exam Questions in here: https://www.fast2test.com/Professional-Cloud-Network-Engineer-premium-file.html