Maximum Grades By Making ready With Professional-Cloud-Network-Engineer Dumps UPDATED 2024 [Q32-Q57]

Maximum Grades By Making ready With Professional-Cloud-Network-Engineer Dumps UPDATED 2024

Prepare Professional-Cloud-Network-Engineer Exam Questions [2024] Recently Updated Questions

Google Professional-Cloud-Network-Engineer exam is a certification that validates the skills and knowledge of professionals in designing, implementing, and managing solutions leveraging Google Cloud Platform networks. Google Cloud Certified - Professional Cloud Network Engineer certification is suitable for individuals who aspire to become network engineers, network architects, or cloud engineers. Google Professional-Cloud-Network-Engineer certification is a highly recognized qualification in the industry.

 

NEW QUESTION # 32
You are configuring an HA VPN connection between your Virtual Private Cloud (VPC) and on-premises network. The VPN gateway is named VPN_GATEWAY_1. You need to restrict VPN tunnels created in the project to only connect to your on-premises VPN public IP address: 203.0.113.1/32. What should you do?

• A. Configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address.
• B. Configure a firewall rule accepting 203.0.113.1/32, and set a target tag equal to VPN_GATEWAY_1.
• C. Configure an access control list on the peer VPN gateway to deny all traffic except 203.0.113.1/32, and attach it to the primary external interface.
• D. Configure a Google Cloud Armor security policy, and create a policy rule to allow 203.0.113.1/32.

Answer: A

NEW QUESTION # 33
An application development team believes their current logging tool will not meet their needs for their new cloud-based product. They want a better tool to capture errors and help them analyze their historical log data. You want to help them find a solution that meets their needs, what should you do?

• A. Send them a list of online resources about logging best practices.
• B. Help them define their requirements and assess viable logging tools.
• C. Direct them to download and install the Google StackDriver logging agent.
• D. Help them upgrade their current tool to take advantage of any new features.

Answer: B

Explanation:
A and D can be ruled out for them are not general IT good practices. They need your help, not just simply to sell your products, or point them to the crowded resource without explains.
B (Correct Answer) - Help them define their requirements and assess viable logging tools. They know the requirements and the existing tools' problems. While it's true StackDriver Logging and Error Reporting meet all their requirements, they need you to provide expertise to make assessment for new tools, specifically, logging tools that can capture errors and help them analyze their historical log data?
C - Help them upgrade their current tool to take advantage of any new features. They have already used and know those tools' shortcomings. They need your help to find better one. Simply help them upgrade for new features is not enough and may not resolve the problems

NEW QUESTION # 34
Your company has launched a mobile application that uploads pictures to google cloud storage bucket. The application was successfully uploading the pictures to google cloud storage buckets, but lately the application has become popular and you start seeing 429 errors. Please suggest the ways to address the issue. Please select any two.

• A. The OAuth access token has expired and needs to be refreshed.
• B. Use truncated exponential backoff
• C. Use the correct verb with the /upload or /download URLs.
• D. Throttle your client's requests

Answer: B

Explanation:
Option A and Option B are the Correct choices because , a 429 error is caused by Too Many Requests.If your application tries to use more than its limit, additional requests will fail. Throttle your client's requests, and/or use truncated exponential backoff.
Option C is Incorrect choice because, a OAuth access token has expiry would result in error
401(Unauthorized)
Option D is Incorrect because, using wrong verb with /upload or /download URLs would lead to
405 (method not allowed error).

NEW QUESTION # 35
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?

• A. Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
• B. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
• C. Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
• D. Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.

Answer: B

Explanation:
https://cloud.google.com/load-balancing/docs/health-check-concepts#content-based_health_checks

NEW QUESTION # 36
You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the on-premises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel. Which filter should you use in Cloud Logging to examine the logs?

• A. resource.type= "vpn_gateway"
• B. resource.type= "gce_router"
• C. resource.type= "gce_network_region"
• D. resource.type= "vpn_tunnel"

Answer: D

NEW QUESTION # 37
You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses.
Which subnet mask should you use for the Pod IP address range?

• A. /21
• B. /23
• C. /22
• D. /25

Answer: C

Explanation:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips#cluster_sizing_secondary_range_pods Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr
https://cloud.google.com/kubernetes-engine/docs/concepts/alias-ips#defaults_limits

NEW QUESTION # 38
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?

• A. Grant the compute.instanceAdminto your user account.
• B. Grant the cloud-platformprivilege to the service account for the Cloud Storage bucket.
• C. Grant the iam.serviceAccountUserto your user account.
• D. Grant the read-onlyprivilege to the service account for the Cloud Storage bucket.

Answer: C

Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/access/iam

NEW QUESTION # 39
You have enabled HTTP(S) load balancing for your application, and your application developers have reported that HTTP(S) requests are not being distributed correctly to your Compute Engine Virtual Machine instances. You want to find data about how the request are being distributed.
Which two methods can accomplish this? (Choose two.)

• A. In Stackdriver Monitoring, select Resources > Google Cloud Load Balancers and review the Key Metrics graphs in the dashboard.
• B. In Stackdriver Error Reporting, look for any unacknowledged errors for the Cloud Load Balancers service.
• C. On the Load Balancer details page of the GCP Console, click on the Monitoring tab, select your backend service, and look at the graphs.
• D. In Stackdriver Monitoring, create a new dashboard and track the https/backend_request_count metric for the load balancer.
• E. In Stackdriver Monitoring, select Resources > Metrics Explorer and search for https/request_bytes_count metric.

Answer: C,D

NEW QUESTION # 40
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments.
* Each organization has enabled full connectivity between all of its projects by using Shared VPC.
* Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
* There are no prefix overlaps between the two organizations.
* Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.
* Neither organization has Interconnects to their on-premises environment.
You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.
Which two steps should you take? (Choose two.)

• A. Provision Cloud Interconnect to connect both organizations together.
• B. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
• C. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC.
• D. Set up some variant of DNS forwarding and zone transfers in each organization.
• E. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.

Answer: B,D

Explanation:
https://cloud.google.com/dns/docs/best-practices

NEW QUESTION # 41
You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?

• A. Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways. Enable global dynamic routing in each VPC.
• B. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner's VPC. Connect your VPN gateway to your partner's servers.
• C. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways with a pair of tunnels. Enable global dynamic routing in each VPC.
• D. Create one OpenVPN Access Server in each region of your VPC and your partner's VPC. Connect your servers to the partner's servers.

Answer: A

NEW QUESTION # 42
You work for a multinational enterprise that is moving to GCP.
These are the cloud requirements:
* An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup)
* Multiple regional offices in Europe and APAC
* Regional data processing is required in europe-west1 and australia-southeast1
* Centralized Network Administration Team
Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us-west1.
What should you do?

• A. * Create 2 VPCs in a Shared VPC Host Project.* Configure a 2-NIC instance in zone us-west1-a in the Service Project.* Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.* Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.
• B. * Create 1 VPC in a Shared VPC Host Project.* Configure a 2-NIC instance in zone us-west1-a in the Host Project.* Attach NIC0 in us-west1 subnet of the Host Project.* Attach NIC1 in us-west1 subnet of the Host Project* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.
• C. * Create 1 VPC in a Shared VPC Service Project.* Configure a 2-NIC instance in zone us-west1-a in the Service Project.* Attach NIC0 in us-west1 subnet of the Service Project.* Attach NIC1 in us-west1 subnet of the Service Project* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.
• D. * Create 2 VPCs in a Shared VPC Host Project.* Configure a 2-NIC instance in zone us-west1-a in the Host Project.* Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.* Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.

Answer: A

Explanation:
https://cloud.google.com/vpc/docs/shared-vpc

NEW QUESTION # 43
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?

• A. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
• B. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
• C. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
• D. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.

Answer: B

NEW QUESTION # 44
You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?

• A. Use Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.
• B. Use global SSL Proxy Load Balancing with backends in both regions.
• C. Use global external HTTP(S) Load Balancing with backends in both regions.
• D. Use global TCP Proxy Load Balancing with backends in both regions.

Answer: A

NEW QUESTION # 45
You recently deployed Compute Engine instances in regions us-west1 and us-east1 in a Virtual Private Cloud (VPC) with default routing configurations. Your company security policy mandates that virtual machines (VMs) must not have public IP addresses attached to them. You need to allow your instances to fetch updates from the internet while preventing external access. What should you do?

• A. Create a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.
• B. Change the instances' network interface external IP address from None to Ephemeral.
• C. Create a single global Cloud NAT gateway and global Cloud Router in the VPC.
• D. Create a firewall rule that allows egress to destination 0.0.0.0/0.

Answer: A

NEW QUESTION # 46
You have the following routing design. You discover that Compute Engine instances in Subnet-2 in the asia-southeast1 region cannot communicate with compute resources on-premises. What should you do?

• A. Change the VPC dynamic routing mode to Global.
• B. Configure a custom route advertisement on the Cloud Router.
• C. Enable IP forwarding in the asia-southeast1 region.
• D. Add a second Border Gateway Protocol (BGP) session to the Cloud Router.

Answer: A

NEW QUESTION # 47
You have created several preemptible Linux virtual machine instances using Google Compute Engine. You want to properly shut down your application before the virtual machines are preempted. What should you do?

• A. Create a shutdown script and use it as the value for a new metadata entry with the key shutdown- script in the Cloud Platform Console when you create the new virtual machine instance.
• B. Create a shutdown script named shutdown in the /etc/ directory.
• C. Create a shutdown script, registered as a xinetd service in Linux, and use the gcloud compute instances add-metadata command to specify the service URL as the value for a new metadata entry with the key shutdown-script-url
• D. Create a shutdown script registered as a xinetd service in Linux and configure a StackDriver endpoint check to call the service.

Answer: A

Explanation:
Running Shutdown Scripts "Create and run shutdown scripts that execute commands right before an instance is terminated or restarted, on a best-effort basis. This is useful if you rely on automated scripts to start up and shut down instances, allowing instances time to clean up or perform tasks, such as exporting logs, or syncing with other systems."
https://cloud.google.com/compute/docs/shutdownscript
To setup Shutdown Scripts, go to GCP console and follow the steps:
Compute Engine -> VM instance -> Create Instance -> (Expand) Management, disks, networking, SSH keys Enter the key "shutdown-script" and proper value

NEW QUESTION # 48
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?

• A. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
• B. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
• C. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
• D. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.

Answer: D

Explanation:
https://cloud.google.com/network-connectivity/docs/vpn/concepts/classic-topologies#redundancy-options

NEW QUESTION # 49
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?

• A. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
• B. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
• C. Create unique DNS records for each service that sends traffic to the desired IP address.
• D. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.

Answer: C

NEW QUESTION # 50
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments.
* Each organization has enabled full connectivity between all of its projects by using Shared VPC.
* Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
* There are no prefix overlaps between the two organizations.
* Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.
* Neither organization has Interconnects to their on-premises environment.
You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.
Which two steps should you take? (Choose two.)

• A. Provision Cloud Interconnect to connect both organizations together.
• B. Set up some variant of DNS forwarding and zone transfers in each organization.
• C. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
• D. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC
• E. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.

Answer: A,C

NEW QUESTION # 51
You are configuring your Google Cloud environment to connect to your on-premises network. Your configuration must be able to reach Cloud Storage APIs and your Google Kubernetes Engine nodes across your private Cloud Interconnect network. You have already configured a Cloud Router with your Interconnect VLAN attachments. You now need to set up the appropriate router advertisement configuration on the Cloud Router. What should you do?

• A. Configure the route advertisement to the custom setting, and manually add prefix 199.36.153.8/30 to the list of advertisements. Advertise all visible subnets to the Cloud Router.
• B. Configure the route advertisement to the custom setting, and manually add prefix 199.36.153.8/30 to the list of advertisements. Leave all other options as their default settings.
• C. On the on-premises router, configure a static route for the storage API virtual IP address which points to the Cloud Router's link-local IP address.
• D. Configure the route advertisement to the default setting.

Answer: B

NEW QUESTION # 52
You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket, You are using the VSE ORIG.-X_NZADERS cache mode You receive an HTTP 403 error when opening the file In your browser and you see that the HTTP response has a Cache-control: private, max-age=O header How should you correct this Issue?

• A. Increase the default time-to-live (TTL) for the backend service.
• B. Enable negative caching for the backend bucket
• C. Configure a Cloud Storage bucket permission that gives the Storage Legacy Object Reader role
• D. Change the cache mode to cache all content.

Answer: C

Explanation:
The correct answer is A. Configure a Cloud Storage bucket permission that gives the Storage Legacy Object Reader role.
This answer is based on the following facts:
Cloud CDN can serve private content from Cloud Storage buckets, but you need to grant the appropriate permissions to the Google-managed service account that represents your load balancer1.
The Storage Legacy Object Reader role grants read access to objects in a bucket2.
The Cache-control: private header indicates that the object is not publicly readable and requires authentication3.
The USE_ORIGIN_HEADERS cache mode instructs Cloud CDN to cache responses based on the Cache-Control and Expires headers from the origin server4. Changing the cache mode, increasing the TTL, or enabling negative caching will not affect the 403 error.

NEW QUESTION # 53
You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider.
Which connection type should you choose?

• A. Partner Interconnect
• B. Direct Peering
• C. Dedicated Interconnect
• D. Carrier Peering

Answer: B

Explanation:
Reference:
https://cloud.google.com/interconnect/docs/how-to/direct-peering

NEW QUESTION # 54
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?

• A. Create an explicit Deny Any rule and enable logging on the new rule.
• B. Create a logging sink forwarding all firewall logs with no filters.
• C. Enable logging on the VM Instances that receive traffic.
• D. Enable logging on the default Deny Any Firewall Rule.

Answer: A

Explanation:
https://cloud.google.com/vpc/docs/firewall-rules-logging#egress_deny_example You can only enable Firewall Rules Logging for rules in a Virtual Private Cloud (VPC) network. Legacy networks are not supported. Firewall Rules Logging only records TCP and UDP connections. Although you can create a firewall rule applicable to other protocols, you cannot log their connections. You cannot enable Firewall Rules Logging for the implied deny ingress and implied allow egress rules. Log entries are written from the perspective of virtual machine (VM) instances. Log entries are only created if a firewall rule has logging enabled and if the rule applies to traffic sent to or from the VM. Entries are created according to the connection logging limits on a best effort basis. The number of connections that can be logged in a given interval is based on the machine type. Changes to firewall rules can be viewed in VPC audit logs. https://cloud.google.com/vpc/docs/firewall-rules-logging#specifications

NEW QUESTION # 55
You have setup a shared VPC and you have created three projects; Host Project, Service Project-1 and Service Project-2. You have created two subnets, subnet-1 in us-west1 and subnet-
2 in us-central1 in the Host Project. Only subnet-1 has been shared with Service Project -1 but when you go to VPC networks in Service Project-1 you also see subnet-2 which hasn't been shared with Service Project-1. Please select the correct option from below why is subnet-2 available to Service Project-1. Note Host Project is the Host Project in the shared VPC, Service Project-1 and Service project-2 are the Service Projects in the shared VPC.

• A. It is a bug in Google Cloud, please report it.
• B. By default all subnets are available.
• C. The current user has Shared VPC Admin role and with Shared VPC Admin role all the networks are available.
• D. Remove Shared Network admin role to the current user.

Answer: C

Explanation:
Option A is the Correct choice because , if the current user has Shared VPC Admin role then all the networks in the shared VPC is the available to the user irrespective of subnet level sharing permission with the Service Projects.
Option B is Incorrect because , it is not a bug .
Option C is Incorrect because ,all the subnets would be available if the current user has Shared Admin role.
Option D is Incorrect because ,Shared Network Admin role doesn't exist.

NEW QUESTION # 56
Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.
How should you deploy this service in GCP?

• A. Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
• B. Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.
• C. Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal-priority static routes to the backend servers.
• D. Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.

Answer: D

NEW QUESTION # 57
......

Give push to your success with Professional-Cloud-Network-Engineer exam questions: https://torrentvce.exam4free.com/Professional-Cloud-Network-Engineer-valid-dumps.html