Professional-Cloud-Network-Engineer Exam Questions Dumps, Selling Google Products
Professional-Cloud-Network-Engineer Cert Guide PDF 100% Cover Real Exam Questions
Google Professional-Cloud-Network-Engineer Exam is intended for network professionals who want to demonstrate their skills in designing and implementing network solutions on the Google Cloud Platform. Professional-Cloud-Network-Engineer exam covers a wide range of topics, including network design, network security, network optimization, and network management. By passing Professional-Cloud-Network-Engineer exam, you will prove that you possess the skills required to deploy and manage network infrastructure on the Google Cloud Platform.
NEW QUESTION # 53
You built a web application with several containerized microservices. You want to run those microservices on Cloud Run. You must also ensure that the services are highly available to your customers with low latency. What should you do?
- A. Deploy the Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTPS load balancer, and attach the Cloud Endpoints to its backend
- B. Deploy the Cloud Run services to multiple regions. Configure a round-robin A record in Cloud DNS.
- C. Deploy the Cloud Run services to multiple availability zones. Create a global TCP load balancer. Add the Cloud Run endpoints to its backend service.
- D. Deploy the Cloud Run services to multiple regions. Create serverless network endpoint groups (NEGs) that point to the services. Create a global HTTPS load balancer, and attach the serverless NEGs as backend services of the load balancer.
Answer: D
NEW QUESTION # 54
You are configuring an HA VPN connection between your Virtual Private Cloud (VPC) and on-premises network. The VPN gateway is named VPN_GATEWAY_1. You need to restrict VPN tunnels created in the project to only connect to your on-premises VPN public IP address: 203.0.113.1/32. What should you do?
- A. Configure a Google Cloud Armor security policy, and create a policy rule to allow 203.0.113.1/32.
- B. Configure an access control list on the peer VPN gateway to deny all traffic except 203.0.113.1/32, and attach it to the primary external interface.
- C. Configure a firewall rule accepting 203.0.113.1/32, and set a target tag equal to VPN_GATEWAY_1.
- D. Configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address.
Answer: D
NEW QUESTION # 55
You have two Google Cloud projects in a perimeter to prevent data exfiltration. You need to move a third project inside the perimeter; however, the move could negatively impact the existing environment. You need to validate the impact of the change. What should you do?
- A. Modify the existing VPC Service Controls policy to include the new project in dry run mode.
- B. Monitor the Resource Manager audit logs inside the perimeter.
- C. Enable VPC Flow Logs inside the third project, and monitor the logs for negative impact.
- D. Enable Firewall Rules Logging inside the third project.
Answer: A
NEW QUESTION # 56
After a network change window one of your company's applications stops working. The application uses an on-premises database server that no longer receives any traffic from the application. The database server IP address is 10.2.1.25. You examine the change request, and the only change is that 3 additional VPC subnets were created. The new VPC subnets created are 10.1.0.0/16, 10.2.0.0/16, and 10.3.1.0/24/ The on-premises router is advertising 10.0.0.0/8.
What is the most likely cause of this problem?
- A. The less specific VPC subnet route is taking priority.
- B. The on-premises router is not advertising a route for the database server.
- C. The more specific VPC subnet route is taking priority.
- D. A cloud firewall rule that blocks traffic to the on-premises database server was created during the change.
Answer: D
NEW QUESTION # 57
You need to create the network infrastructure to deploy a highly available web application in the us-east1 and us-west1 regions.
The application runs on Compute Engine instances, and it does not require the use of a database. You want to follow Google-recommended practices. What should you do?
- A. Create one VPC with one subnet in each region.
Create an HTTP(S) load balancer with a static IP address.
Choose the standard tier for the network.
Enable Cloud CDN on the load balancer.
Create a CNAME record using the load balancer's IP address in Cloud DNS. - B. Create one VPC with one subnet in each region.
Create a regional network load balancer in each region with a static IP address.
Enable Cloud CDN on the load balancers.
Create an A record in Cloud DNS with both IP addresses for the load balancers. - C. Create one VPC with one subnet in each region.
Create a global load balancer with a static IP address.
Enable Cloud CDN and Google Cloud Armor on the load balancer.
Create an A record using the IP address of the load balancer in Cloud DNS. - D. Create one VPC in each region, and peer both VPCs.
Create a global load balancer.
Enable Cloud CDN on the load balancer.
Create a CNAME for the load balancer in Cloud DNS.
Answer: D
NEW QUESTION # 58
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with on-premises connectivity already in place. You are deploying a new application using Google Kubernetes Engine (GKE), which must be accessible only from the same VPC network and on-premises locations. You must ensure that the GKE control plane is exposed to a predefined list of on-premises subnets through private connectivity only. What should you do?
- A. Create a GKE public cluster. Configure authorized networks to specify the desired on-premises subnets.
- B. Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.
- C. Create a GKE private cluster with a private endpoint for the control plane. Configure authorized networks to specify the desired on-premises subnets.
- D. Create a GKE private cluster with a public endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.
Answer: C
NEW QUESTION # 59
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?
- A. Create unique DNS records for each service that sends traffic to the desired IP address.
- B. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
- C. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
- D. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
Answer: D
NEW QUESTION # 60
You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only.
How should you configure your firewall rules?
- A. Create a single firewall rule to allow port 22 with priority 1000.
- B. Create two firewall rules: one to block all traffic with priority 0, and another to allow port 22 with priority 1000.
- C. Create a single firewall rule to allow port 3389 with priority 1000.
- D. Create two firewall rules: one to block all traffic with priority 65536, and another to allow port 3389 with priority 1000.
Answer: A
Explanation:
Reference:
https://geekflare.com/gcp-firewall-configuration/
NEW QUESTION # 61
Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.
How should you deploy this service in GCP?
- A. Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
- B. Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.
- C. Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal-priority static routes to the backend servers.
- D. Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.
Answer: B
NEW QUESTION # 62
All the instances in your project are configured with the custom metadata enable-osloginvalue set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project- wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
- B. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- C. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- D. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION # 63
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
- B. Assign members of the networking team the compute.networkAdmin role.
- C. Assign members of the networking team the compute.networkUser role.
- D. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.
Answer: B
NEW QUESTION # 64
You are using the gcloudcommand line tool to create a new custom role in a project by copying a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicypermission, and try again.
- B. Add the resourcemanager.projects.getpermission, and try again.
- C. Try again with a different role with a new name but the same permissions.
- D. Remove the resourcemanager.projects.listpermission, and try again.
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/understanding-custom-roles
NEW QUESTION # 65
Refer to the exhibit.
You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):
You need to update the firewall rule to add the following rule to the ruleset:
You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?
- A. Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.
- B. Assign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
- C. Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
- D. Assign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.
Answer: D
NEW QUESTION # 66
You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicy permission, and try again.
- B. Add the resourcemanager.projects.get permission, and try again.
- C. Try again with a different role with a new name but the same permissions.
- D. Remove the resourcemanager.projects.list permission, and try again.
Answer: D
NEW QUESTION # 67
You have a storage bucket that contains the following objects:
- folder-a/image-a-1.jpg
- folder-a/image-a-2.jpg
- folder-b/image-b-1.jpg
- folder-b/image-b-2.jpg
Cloud CDN is enabled on the storage bucket, and all four objects have been successfully cached. You want to remove the cached copies of all the objects with the prefix folder-a, using the minimum number of commands.
What should you do?
- A. Issue a cache invalidation command with pattern /folder-a/*.
- B. Make sure that all the objects with prefix folder-a are not shared publicly.
- C. Add an appropriate lifecycle rule on the storage bucket.
- D. Disable Cloud CDN on the storage bucket. Wait 90 seconds. Re-enable Cloud CDN on the storage bucket.
Answer: A
Explanation:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Invalidation.html
NEW QUESTION # 68
You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)
- A. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
- B. Turn on Private Google Access at the subnet level.
- C. Turn on Private Google Access at the VPC level.
- D. Turn on Private Services Access at the VPC level.
- E. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
Answer: D,E
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/private-access-options
NEW QUESTION # 69
One instance in your VPC is configured to run with a private IP address only. You want to ensure that even if this instance is deleted, its current private IP address will not be automatically assigned to a different instance.
In the GCP Console, what should you do?
- A. Add custom metadata to the instance with key internal-address and value reserved.
- B. Assign a public IP address to the instance.
- C. Change the instance's current internal IP address to static.
- D. Assign a new reserved internal IP address to the instance.
Answer: D
NEW QUESTION # 70
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?
- A. Create a custom Google Compute Engine image with your public ssh key embedded.
- B. Upload your public ssh key to the project Metadata.
- C. Upload your public ssh key to each instance Metadata.
- D. Use gcloud compute ssh to automatically copy your public ssh key to the instance.
Answer: B
Explanation:
Overview By creating and managing SSH keys, you can let users access a Linux instance through third-party tools. An SSH key consists of the following files: A public SSH key file that is applied to instance-level metadata or project-wide metadata. A private SSH key file that the user stores on their local devices. If a user presents their private SSH key, they can use a third-party tool to connect to any instance that is configured with the matching public SSH key file, even if they aren't a member of your Google Cloud project. Therefore, you can control which instances a user can access by changing the public SSH key metadata for one or more instances. https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#addkey
NEW QUESTION # 71
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the read-only privilege to the service account for the Cloud Storage bucket.
- B. Grant the compute.instanceAdmin to your user account.
- C. Grant the iam.serviceAccountUser to your user account.
- D. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
Answer: C
Explanation:
https://cloud.google.com/compute/docs/access/iam
NEW QUESTION # 72
......
Pass Professional-Cloud-Network-Engineer Exam - Real Questions and Answers: https://torrentvce.exam4free.com/Professional-Cloud-Network-Engineer-valid-dumps.html
