Unique Top-selling Professional-Cloud-Network-Engineer Exams - New 2021 Google Pratice Exam
Google Cloud Platform Dumps Professional-Cloud-Network-Engineer Exam for Full Questions - Exam Study Guide
The certification exam will measure the skills and knowledge of the candidates across seven different domains. The highlights of these areas are as follows:
Design, Plan, and Prototype GCP Networks
- Design Hybrid Networks: The questions from this subtopic will measure the expertise of the learners in peering options, IPsec VPN, using interconnects, cross-organization access, standalone versus shared VPC interconnect access, Cloud router, as well as failover & disaster recovery strategy.
- Design Virtual Private Cloud: This section covers the individuals’ skills in peering, multiple versus single, shared or standalone, CIDR range for the subnets, and IP address. It also focuses on the concepts, such as routes, firewall, and the differences between other Cloud platforms and Google Cloud Networking;
- Design Overall Network Architectures: The consideration for this topic include alternatives for high availability, failover & disaster recovery plan, DNS strategy, container networking, hybrid connectivity, and optimizing for latency. The certification exam also requires competence in selecting the relevant load balancing options, meeting the business prerequisites, Micro-segmentation for security reasons, IAM & security, and understanding of the way quotas are applied based on project and VPC;
NEW QUESTION 47
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?
- A. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
- B. Create unique DNS records for each service that sends traffic to the desired IP address.
- C. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
- D. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
Answer: C
NEW QUESTION 48
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are
100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Tune TCP parameters on the on-premises servers.
- B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- C. Compress files using utilities like tar to reduce the size of data being sent.
- D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
Answer: D
Explanation:
https://cloud.google.com/solutions/transferring-big-data-sets-to-gcp
NEW QUESTION 49
Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances.
Which two products should you incorporate into the solution? (Choose two.)
- A. Cloud Audit logs
- B. Compute Engine instance system logs
- C. VPC flow logs
- D. Stackdriver Trace
- E. Firewall logs
Answer: C,E
Explanation:
A: Using VPC Flow Logs VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes. These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization. https://cloud.google.com/vpc/docs/using-flow-logs (B): Firewall Rules Logging overview Firewall Rules Logging allows you to audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Firewall Rules Logging is also useful if you need to determine how many connections are affected by a given firewall rule. You enable Firewall Rules Logging individually for each firewall rule whose connections you need to log. Firewall Rules Logging is an option for any firewall rule, regardless of the action (allow or deny) or direction (ingress or egress) of the rule. https://cloud.google.com/vpc/docs/firewall-rules-logging
NEW QUESTION 50
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. Create a Cloud VPN instance.
Create a policy-based VPN tunnel per subnet.
Configure the appropriate local and remote traffic selectors to match your local and remote networks.
Create the appropriate static routes. - B. Create a Cloud VPN instance.
Create a route-based VPN tunnel.
Configure the appropriate local and remote traffic selectors to match your local and remote networks.
Configure the appropriate static routes. - C. Create a Cloud VPN instance.
Create a policy-based VPN tunnel.
Configure the appropriate local and remote traffic selectors to match your local and remote networks.
Configure the appropriate static routes. - D. Create a Cloud VPN instance.
Create a route-based VPN tunnel.
Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.
Configure the appropriate static routes.
Answer: D
Explanation:
https://cloud.google.com/vpn/docs/concepts/choosing-networks-routing
NEW QUESTION 51
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC- native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
- B. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC- native cluster and specify those ranges.
- C. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-aliasto create a VPC-native cluster.
- D. Use gcloud container clusters create [CLUSTER NAME]to create a VPC-native cluster.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters
NEW QUESTION 52
All the instances in your project are configured with the custom metadata enable-osloginvalue set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project- wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- B. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
- C. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- D. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION 53
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
* Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
* The subnetwork logs are not excluded from Stackdriver.
* The instance that is hosting the application can communicate outside the subnet.
* Other instances within the subnet can communicate outside the subnet.
* The external resource initiates communication.
What is the most likely cause of the missing log lines?
- A. The traffic is matching the expected ingress rule.
- B. The traffic is matching the expected egress rule.
- C. The traffic is not matching the expected ingress rule.
- D. The traffic is not matching the expected egress rule.
Answer: C
NEW QUESTION 54
You are using the gcloudcommand line tool to create a new custom role in a project by copying a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicypermission, and try again.
- B. Add the resourcemanager.projects.getpermission, and try again.
- C. Try again with a different role with a new name but the same permissions.
- D. Remove the resourcemanager.projects.listpermission, and try again.
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/understanding-custom-roles
NEW QUESTION 55
You work for a university that is migrating to GCP.
These are the cloud requirements:
- On-premises connectivity with 10 Gbps
- Lowest latency access to the cloud
- Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects.
You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use standalone projects, and deploy the VLAN attachments in the individual projects.
Connect the VLAN attachment to the standalone projects' Interconnects. - B. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
- C. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- D. Use Shared VPC, and deploy the VLAN attachments in the service projects.
Connect the VLAN attachment to the Shared VPC's host project.
Answer: D
NEW QUESTION 56
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
- B. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- C. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- D. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
Answer: A
Explanation:
https://cloud.google.com/sdk/gcloud/reference/dns/record-sets/import
NEW QUESTION 57
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. SSL proxy load balancer
- B. Network load balancer
- C. TCP proxy load balancer
- D. HTTPS load balancer
Answer: C
Explanation:
https://cloud.google.com/security/encryption-in-transit/ Automatic encryption between GFEs and backends For the following load balancer types, Google automatically encrypts traffic between Google Front Ends (GFEs) and your backends that reside within Google Cloud VPC networks: HTTP(S) Load Balancing TCP Proxy Load Balancing SSL Proxy Load Balancing
NEW QUESTION 58
You are a admin at XYZ organization. Few of your team members need to use BigQuery Data Transfer Service for Amazon S3 . They want to automatically schedule and manage recurring load jobs from Amazon S3 into BigQuery, they want to run the transfer job every week. They have, Amazon S3 URI for the source data, access key ID , secret access key and Read permission on the data source . What necessary permissions are required for the transfer job creators in BigQuery .
- A. bigquery.transfer.get and bigquery.data.sets.update
- B. bigquery.transfers.update and bigquery.transfers.get
- C. bigquery.jobs.create and bigquery.transfers.get
- D. bigquery.transfers.update and bigquery.datasets.update
Answer: D
Explanation:
Option A is the correct choice because bigquery.transfers.update permissions is needed to create the transfer and bigquery.datasets.update permissions is needed on the target dataset .Also The bigquery.admin predefined Cloud IAM role includes bigquery.transfers.update and bigquery.datasets.update permissions .
Option B is Incorrect because , it is not the required permission for transfer job creators.
Option C and Option D are Incorrect because , they are not the required permission for transfer job creators.
NEW QUESTION 59
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?
- A. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
- B. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
- C. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
- D. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
Answer: C
Explanation:
VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.
NEW QUESTION 60
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale.
How should you provision your instances?
- A. Create a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.
- B. Create an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.
- C. Create a single managed instance group, specify the desired region, and select Multiple zones for the location.
- D. Create an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.
Answer: A
Explanation:
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed- instance-groups
NEW QUESTION 61
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the private attribute.
- B. Ensure that the object you don't want to be cached anymore is not shared publicly.
- C. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
- D. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
Answer: B
Explanation:
Reference:
https://developers.google.com/web/ilt/pwa/caching-files-with-service-worker
NEW QUESTION 62
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/ Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection.
Which two actions can accomplish this? (Choose two.)
- A. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
- B. Open a Cloud Support ticket under the Cloud Interconnect category.
- C. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.
- D. Check the email for the account of the NOC contact that you specified during the ordering process.
- E. Run gcloud compute interconnects describe <interconnect>.
Answer: C,D
NEW QUESTION 63
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
Which BGP attribute should you use on your on-premises router?
- A. Multi-exit Discriminator
- B. AS-Path
- C. Local Preference
- D. Community
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/router/docs/concepts/overview
NEW QUESTION 64
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. None
- B. Client IP
- C. Client IP, port and protocol
- D. Client IP and protocol
Answer: B
NEW QUESTION 65
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Add a Cache-Controlentry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
- B. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the privateattribute.
- C. Ensure that the object you don't want to be cached anymore is not shared publicly.
- D. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
Answer: C
Explanation:
Explanation/Reference: https://developers.google.com/web/ilt/pwa/caching-files-with-service-worker
NEW QUESTION 66
You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only.
How should you configure your firewall rules?
- A. Create a single firewall rule to allow port 22 with priority 1000.
- B. Create a single firewall rule to allow port 3389 with priority 1000.
- C. Create two firewall rules: one to block all traffic with priority 0, and another to allow port 22 with priority 1000.
- D. Create two firewall rules: one to block all traffic with priority 65536, and another to allow port 3389 with priority 1000.
Answer: A
NEW QUESTION 67
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
- A. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
- B. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
- C. Rename the default VPC as "Distribution" and peer it via network peering.
- D. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
Answer: B
NEW QUESTION 68
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command.
Which next hop should you choose?
- A. The IP address of the Cloud VPN gateway
- B. The IP address of the instance on the remote side of the VPN tunnel
- C. The name and region of the Cloud VPN tunnel
- D. The default internet gateway
Answer: C
Explanation:
Reference:
https://cloud.google.com/vpn/docs/how-to/creating-static-vpns
NEW QUESTION 69
You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours.
Which connectivity method should you choose?
- A. Dedicated Interconnect, but don't provision any VLAN attachments
- B. Dedicated Interconnect with a single VLAN attachment
- C. Cloud VPN
- D. 50-Mbps Partner VLAN attachment
Answer: C
NEW QUESTION 70
......
Best way to practice test for Google Professional-Cloud-Network-Engineer: https://www.fast2test.com/Professional-Cloud-Network-Engineer-premium-file.html
Professional-Cloud-Network-Engineer Dump Ready - Exam Questions and Answers: https://drive.google.com/open?id=1A7F5DTj0kLF3gKS8Y2dmKIE0SlwtaI2V