Authentic Professional-Cloud-Network-Engineer Dumps With 100% Passing Rate Practice Tests Dumps
Google Professional-Cloud-Network-Engineer Real Exam Questions Guaranteed Updated Dump from Prep4King
NEW QUESTION # 79
You recently deployed Cloud VPN to connect your on-premises data center to Google Cloud. You need to monitor the usage of this VPN and set up alerts in case traffic exceeds the maximum allowed. You need to be able to quickly decide whether to add extra links or move to a Dedicated Interconnect. What should you do?
- A. In the Monitoring section of the Google Cloud console, use the Dashboard section to select a default dashboard for VPN usage.
- B. In the VPN section of the Google Cloud console, select the VPN under hybrid connectivity and then select monitoring to display utilization on the dashboard.
- C. In Network Intelligence Center, check for the number of packet drops on the VPN.
- D. In the Google Cloud console, use Monitoring Query Language to create a custom alert for bandwidth utilization.
Answer: D
Explanation:
Using Monitoring Query Language (MQL) to create a custom alert for bandwidth utilization gives you flexibility and precision in setting thresholds. This helps you quickly determine when VPN traffic exceeds the limits, allowing for timely decisions about adding more links or transitioning to a Dedicated Interconnect.
NEW QUESTION # 80
You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicy permission, and try again.
- B. Add the resourcemanager.projects.get permission, and try again.
- C. Try again with a different role with a new name but the same permissions.
- D. Remove the resourcemanager.projects.list permission, and try again.
Answer: D
Explanation:
Reference:
https://cloud.google.com/iam/docs/understanding-custom-roles
NEW QUESTION # 81
Your organization has a new security policy that requires you to monitor all egress traffic payloads from your virtual machines in the us-west2 region. You deployed an intrusion detection system (IDS) virtual appliance in the same region to meet the new policy. You now need to integrate the IDS into the environment to monitor all egress traffic payloads from us-west2. What should you do?
- A. Enable VPC Flow Logs. Create a sink in Cloud Logging to send filtered egress VPC Flow Logs to the IDS.
- B. Enable firewall logging and forward all filtered egress firewall logs to the IDS.
- C. Create an internal HTTP(S) load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.
- D. Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.
Answer: D
Explanation:
Packet Mirroring with an internal TCP/UDP load balancer allows for comprehensive monitoring of egress traffic, which includes payloads. This is required for integration with an IDS for detailed inspection of traffic payloads, meeting the security policy needs for monitoring and detection.
NEW QUESTION # 82
Question:
Your organization is developing a landing zone architecture with the following requirements:
* No communication between production and non-production environments.
* Communication between applications within an environment may be necessary.
* Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules.
* Each application should be billed separately.
* Developers of an application within a project should have the autonomy to create their compute resources.
* Up to 1000 applications are expected per environment.
What should you do?
- A. Create a design that has a Shared VPC for each project. Implement hierarchical firewall policies to apply micro-segmentation between VPCs.
- B. Create a design that implements a single Shared VPC. Use VPC firewall rules with secure tags to enforce micro-segmentation between environments.
- C. Create a design where each project has its own VPC. Ensure all VPCs are connected by a Network Connectivity Center hub that is centrally managed by the network team.
- D. Create a design that has one host project with a Shared VPC for the production environment, another host project with a Shared VPC for the non-production environment, and a service project that is associated with the corresponding host project for each initiative.
Answer: D
Explanation:
Using separate Shared VPCs for production and non-production environments in different host projects (Option D) meets all requirements. This design allows network administrators to centrally manage resources within each Shared VPC while ensuring isolation between environments and separate billing. By associating service projects with each host project, developers can manage resources within their project without affecting the overall VPC network structure.
NEW QUESTION # 83
Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue. What should you do?
- A. Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
- B. Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
- C. Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
- D. Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
Answer: D
Explanation:
Creating a BGP route policy at the Cloud Router ensures that the subnets of the VPC spokes are properly advertised to the on-premises environment. This allows the on-premises router to receive and use those routes. Without the correct BGP policies, route advertisement may not happen as expected.
NEW QUESTION # 84
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security?
(Choose two.)
- A. Dedicated Interconnect
- B. Cloud NAT
- C. Cloud VPN
- D. Shared VPC
- E. VPC peering
Answer: C,E
Explanation:
Google Cloud VPC Network Peering allows internal IP address connectivity across two Virtual Private Cloud (VPC) networks regardless of whether they belong to the same project or the same organization.
NEW QUESTION # 85
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
- Each on-premises router is configured with a unique ASN. ?Each on-
premises router is configured with the same routes and priorities.
- Both on-premises routers are configured with a VPN connected to a
single Cloud Router.
- BGP sessions are established between both on-premises routers and the Cloud Router.
- Only 1 of the on-premises router's routes are being added to the
routing table.
What is the most likely cause of this problem?
- A. The ASNs being used on the on-premises routers are different.
- B. You do not have a load balancer to load-balance the network traffic.
- C. A firewall is blocking the traffic across the second VPN connection.
- D. The on-premises routers are configured with the same routes.
Answer: B
NEW QUESTION # 86
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
- B. Grant the compute.instanceAdmin to your user account.
- C. Grant the read-only privilege to the service account for the Cloud Storage bucket.
- D. Grant the iam.serviceAccountUser to your user account.
Answer: C
NEW QUESTION # 87
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Add a second Cloud VPN gateway in a different region than the existing VPN gateway.
Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address. - B. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- C. Add a second on-premises VPN gateway with a different public IP address.
Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP. - D. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
Answer: B
Explanation:
https://cloud.google.com/vpn/docs/concepts/classic-topologies
NEW QUESTION # 88
You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on- premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team's requirements?
- A. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - B. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
Create a custom route that points Google's private API address range to the default internet gateway as the next hop. - C. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google's private AP address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - D. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
Answer: C
NEW QUESTION # 89
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
- B. Compress files using utilities like tar to reduce the size of data being sent.
- C. Tune TCP parameters on the on-premises servers.
- D. Remove the -m flag from the gsutil command to enable single-threaded transfers.
Answer: C
Explanation:
https://cloud.google.com/solutions/tcp-optimization-for-network-performance-in-gcp-and-hybrid
https://cloud.google.com/solutions/tcp-optimization-for-network-performance-in-gcp-and-hybrid https://cloud.google.com/blog/products/gcp/5-steps-to-better-gcp-network-performance?hl=ml
NEW QUESTION # 90
Your team is developing an application that will be used by consumers all over the world. Currently, the application sits behind a global external application load balancer You need to protect the application from potential application-level attacks. What should you do?
- A. Create a Google Cloud Armor security policy With web application firewall rules, and apply the security policy to the backend service.
- B. Create a VPC Service Controls perimeter with the global external application load balancer as the protected service, and apply it to the backend service
- C. Create multiple firewall deny rules to block malicious users, and apply them to the global external application load balancer
- D. Enable Cloud CDN on the backend service.
Answer: A
Explanation:
The correct answer is C because it meets the requirement of protecting the application from potential application-level attacks. Google Cloud Armor security policies are sets of rules that match on attributes from Layer 3 to Layer 7 to protect externally facing applications1. Web application firewall (WAF) rules are predefined rules that detect and mitigate common web attacks such as cross-site scripting (XSS), SQL injection, remote file inclusion, and more2. By applying a Google Cloud Armor security policy with WAF rules to the backend service, you can filter out malicious requests before they reach your application.
Option A is incorrect because Cloud CDN is a content delivery network that caches static content at the edge of Google's network, but it does not provide any protection against application-level attacks3. Option B is incorrect because firewall rules are applied at the VPC network level, not at the load balancer level4. Firewall rules also only match on Layer 3 and 4 attributes, not on Layer 7 attributes that are relevant for application-level attacks4. Option D is incorrect because VPC Service Controls perimeter is a feature that helps you secure your data from unauthorized access by users outside your organization, but it does not protect your application from external attacks.
Reference:
Security policy overview | Google Cloud Armor
Web application firewall (WAF) rules | Google Cloud Armor
Cloud CDN overview | Google Cloud
Using firewall rules | VPC
[VPC Service Controls overview | Google Cloud]
NEW QUESTION # 91
Your company uses Compute Engine instances that are exposed to the public internet. Each compute instance has a single network interface with a single public IP address. You need to block any connection attempt that originates from internet clients with IP addresses that belong to the bgp_asn_toblock BGP ASN. What should you do?
- A. O Create a new firewall policy ingress rule, and use the -network-src-asns parameter.
- B. Q Create a new Cloud Armor edge security policy, and use the -network-src-asns parameter.
- C. Q Create a new Cloud Armor backend security policy, and use the -network-src-asns parameter.
- D. Q Create a new Cloud Armor network edge security policy, and use the -network-src-asns parameter.
Answer: D
Explanation:
To block traffic based on BGP ASN, you need to use Cloud Armor network edge security policies. Backend security policies protect backend services (like those behind an external HTTP(S) Load Balancer), but for traffic directly to Compute Engine instances with public IPs, you need a network edge security policy.
Firewall policies operate at the VPC level and do not have the capability to filter based on BGP ASN. The - network-src-asns parameter is specifically used with Cloud Armor network edge security policies to filter traffic based on the source ASN.
Exact Extract:
"Cloud Armor network edge security policies can protect external IP addresses of virtual machine (VM) instances and load balancers. They support rules that allow or deny traffic based on various criteria, including source autonomous system numbers (ASNs) using the --network-src-asns parameter."
"Network edge security policies are designed for traffic destined for external IP addresses of Google Cloud resources that are not behind an external HTTP(S) load balancer, such as Compute Engine instances with public IP addresses."Reference: Google Cloud Armor Documentation - Network edge security policies overview
NEW QUESTION # 92
You have a storage bucket that contains the following objects:
- folder-a/image-a-1.jpg
- folder-a/image-a-2.jpg
- folder-b/image-b-1.jpg
- folder-b/image-b-2.jpg
Cloud CDN is enabled on the storage bucket, and all four objects have been successfully cached. You want to remove the cached copies of all the objects with the prefix folder-a, using the minimum number of commands.
What should you do?
- A. Make sure that all the objects with prefix folder-a are not shared publicly.
- B. Issue a cache invalidation command with pattern /folder-a/*.
- C. Add an appropriate lifecycle rule on the storage bucket.
- D. Disable Cloud CDN on the storage bucket. Wait 90 seconds. Re-enable Cloud CDN on the storage bucket.
Answer: A
NEW QUESTION # 93
Question:
You are configuring the firewall endpoints as part of the Cloud Next Generation Firewall (Cloud NGFW) intrusion prevention service in Google Cloud. You have configured a threat prevention security profile, and you now need to create an endpoint for traffic inspection. What should you do?
- A. Create a firewall endpoint within the zone, associate the endpoint to the VPC network, and use a firewall policy rule to apply the L7 inspection.
- B. Attach the profile to the VPC network, create a firewall endpoint within the zone, and use a firewall policy rule to apply the L7 inspection.
- C. Create a Private Service Connect endpoint within the zone, associate the endpoint to the VPC network, and use a firewall policy rule to apply the L7 inspection.
- D. Create a firewall endpoint within the region, associate the endpoint to the VPC network, and use a firewall policy rule to apply the L7 inspection.
Answer: D
Explanation:
For Cloud NGFW in Google Cloud, firewall endpoints are typically created at the regional level, allowing you to associate these with your VPC network for Layer 7 traffic inspection. This regional setup ensures high availability and scales the inspection service across the network.
NEW QUESTION # 94
You need to create the technical architecture for hybrid connectivity from your data center to Google Cloud This will be managed by a partner. You want to follow Google-recommended practices for production-level applications. What should you do?
- A. Configure two Partner Interconnect connections in one metro and two connections in another metro Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure global dynamic routing on the VPC
- B. Configure two Partner Interconnect connections in one metropolitan area (metro). Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in a single region, and configure regional dynamic routing on the VPC
- C. Ask the partner to install two security appliances in the data center. Configure one VPN connection from each of these devices to Google Cloud, and ensure that the VPN devices on-premises are in separate racks on separate power and cooling systems.
- D. Configure two Partner Interconnect connections in one metro and two connections in another metro.Make sure the Interconnect connections are placed in different metro edge availability domains.Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure regional dynamic routing on the VPC.
Answer: D
Explanation:
"Google's recommended practices for production-level applications" and then see overview of these 2 pages-
https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/production-level-overview and
https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/non-critical-overview .
NEW QUESTION # 95
You recently noticed a recurring daily spike in network usage in your Google Cloud project. You need to identify the virtual machine (VM) instances and type of traffic causing the spike in traffic utilization while minimizing the cost and management overhead required. What should you do?
- A. Deploy a third-party network appliance and configure it as the default gateway. Use the third-party network appliance to identify users with high network traffic.
- B. Enable Firewall Rules Logging for all allowed traffic and send the output to BigQuery for analysis.
- C. Enable VPC Flow Logs and send the output to BigQuery for analysis.
- D. Configure Packet Mirroring to send all traffic to a VM. Use Wireshark on the VM to identity traffic utilization for each VM in the VPC.
Answer: D
NEW QUESTION # 96
You have a data workflow which consists of data ingestion layer, data transformation layer, data analytics layer and data storage layer. You are looking for a service that would ease the tasks of creating, scheduling, monitoring and managing workflows without dealing with the management of the infrastructure .Please select the right service that would fulfil the requirement.
- A. Cloud Composer
- B. Apache Airflow
- C. Istio
- D. Stackdriver
Answer: A
Explanation:
Option B is the Correct choice because, Cloud Composer is a managed Apache Airflow service that helps you create, schedule, monitor and manage workflows.
Option A is Incorrect choice because, you could install Apache Airflow on a VM instance but it would mean you will have to manage the infrastructure.
Option C is Incorrect because, Istio an open platform to connect, monitor, and secure microservices.
Option D is Incorrect because, Stackdriver is a monitoring and management for services, containers, applications, and infrastructure.
NEW QUESTION # 97
Your company has separate Virtual Private Cloud (VPC) networks in a single region for two departments: Sales and Finance. The Sales department's VPC network already has connectivity to on-premises locations using HA VPN, and you have confirmed that the subnet ranges do not overlap. You plan to peer both VPC networks to use the same HA tunnels for on-premises connectivity, while providing internet connectivity for the Google Cloud workloads through Cloud NAT. Internet access from the on-premises locations should not flow through Google Cloud. You need to propagate all routes between the Finance department and on-premises locations. What should you do?
- A. Peer the two VPCs, and use the default configuration for the Cloud Routers.
- B. Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network. Use Cloud Router's custom route advertisements to announce the peered VPC network ranges to the on-premises locations.
- C. Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network. Use Cloud Router's custom route advertisements to announce a default route to the on-premises locations.
- D. Peer the two VPCs, and use Cloud Router's custom route advertisements to announce the peered VPC network ranges to the on-premises locations.
Answer: A
NEW QUESTION # 98
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?
- A. Enable logging on the VM Instances that receive traffic.
- B. Create an explicit Deny Any rule and enable logging on the new rule.
- C. Create a logging sink forwarding all firewall logs with no filters.
- D. Enable logging on the default Deny Any Firewall Rule.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/firewall-rules-logging#egress_deny_example You can only enable Firewall Rules Logging for rules in a Virtual Private Cloud (VPC) network. Legacy networks are not supported. Firewall Rules Logging only records TCP and UDP connections. Although you can create a firewall rule applicable to other protocols, you cannot log their connections. You cannot enable Firewall Rules Logging for the implied deny ingress and implied allow egress rules. Log entries are written from the perspective of virtual machine (VM) instances. Log entries are only created if a firewall rule has logging enabled and if the rule applies to traffic sent to or from the VM. Entries are created according to the connection logging limits on a best effort basis. The number of connections that can be logged in a given interval is based on the machine type. Changes to firewall rules can be viewed in VPC audit logs.
https://cloud.google.com/vpc/docs/firewall-rules-logging#specifications
NEW QUESTION # 99
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?
- A. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.
- B. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.
- C. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A.
- D. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag.
Answer: A
NEW QUESTION # 100
Your company is running out of network capacity to run a critical application in the on-premises data center.
You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances.
Which two products should you incorporate into the solution? (Choose two.)
- A. Cloud Audit logs
- B. Stackdriver Trace
- C. VPC flow logs
- D. Firewall logs
- E. Compute Engine instance system logs
Answer: A,B
Explanation:
Explanation/Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
NEW QUESTION # 101
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
- B. Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
- C. Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
- D. Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.
Answer: A
Explanation:
https://cloud.google.com/load-balancing/docs/health-check-concepts#content-based_health_checks
NEW QUESTION # 102
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution.
Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year.
These are the assumptions for both GCP environments.
- Each organization has enabled full connectivity between all of its
projects by using Shared VPC.
- Both organizations strictly use the 10.0.0.0/8 address space for
their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
- There are no prefix overlaps between the two organizations.
- Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.
- Neither organization has Interconnects to their on-premises
environment.
You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.
Which two steps should you take? (Choose two.)
- A. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
- B. Provision Cloud Interconnect to connect both organizations together.
- C. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC.
- D. Set up some variant of DNS forwarding and zone transfers in each organization.
- E. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
Answer: A,B
NEW QUESTION # 103
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
- B. Grant the iam.serviceAccountUser to your user account.
- C. Grant the compute.instanceAdmin to your user account.
- D. Grant the read-only privilege to the service account for the Cloud Storage bucket.
Answer: B
NEW QUESTION # 104
......
Verified Pass Professional-Cloud-Network-Engineer Exam in First Attempt Guaranteed: https://examcollection.prep4king.com/Professional-Cloud-Network-Engineer-latest-questions.html
