Free Professional-Cloud-Network-Engineer Sample Questions and 100% Cover Real Exam Questions (Updated 80 Questions)
Download Real Google Professional-Cloud-Network-Engineer Exam Dumps Test Engine Exam Questions
Difficulty in writing the Google Professional Cloud Network Engineer Exam
Writing Google Professional Cloud Network Engineer could be very difficult for you if you don’t have any experience in terms of on premise network engineering, Still this certification can be cracked by following some tips and tricks. This exam may go hard for you if you had not done its preparation properly. There are many websites that are offering the latest Google Professional Cloud Network Engineer questions and answers but these questions are not verified by Google certified experts and that’s why many are failed in their just first attempt. Prep4King is the best platform which provides the candidate with the necessary Google Professional Cloud Network Engineer exam questions that will help him to pass the Google Professional Cloud Network Engineer on the first time. Candidate will not have to take the Google Professional Cloud Network Engineer twice because with the help of Google Professional Cloud Network Engineer dumps Candidate will have every valuable material required to pass the Google Professional Cloud Network Engineer. We are providing the latest and actual questions and that is the reason why this is the one that he needs to use and there are no chances to fail when a candidate will have valid dumps from Prep4King. We have the guarantee that the questions that we have will be the ones that will pass candidate in the Google Professional Cloud Network Engineer in the very first attempt.
Optimize Network Resources
- Optimize Traffic Flow: This subject area requires an understanding of load balancer & CDN location, accommodating workload improvements, regional versus global dynamic routing, and expanding the subnet CIDR ranges within service;
- Optimize for Efficiency and Cost: This part measures the individuals’ skills in automation, bandwidth utilization, cost optimization, and VPN versus interconnect.
NEW QUESTION 40
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)
- A. Enable Private Google Access on all the subnets.
- B. Enable Private Google Access on the VPC.
- C. Enable Private Services Access on the VPC.
- D. Create network peering between your VPC and BigQuery.
- E. Create a Cloud NAT, and route the application traffic via NAT gateway.
Answer: B,E
NEW QUESTION 41
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
Which BGP attribute should you use on your on-premises router?
- A. Multi-exit Discriminator
- B. AS-Path
- C. Local Preference
- D. Community
Answer: A
NEW QUESTION 42
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
- A. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
- B. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
- C. Rename the default VPC as "Distribution" and peer it via network peering.
- D. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/vpc#ip-ranges
NEW QUESTION 43
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Add a Cache-Controlentry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
- B. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the privateattribute.
- C. Ensure that the object you don't want to be cached anymore is not shared publicly.
- D. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
Answer: C
Explanation:
Explanation/Reference: https://developers.google.com/web/ilt/pwa/caching-files-with-service-worker
NEW QUESTION 44
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
* Your ISP is a Google Partner Interconnect provider.
* Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.
* A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of
500 Mbps due to packet losses.
* Most of the data transfer will be from GCP to the on-premises environment.
* The application can burst up to 1.5 Gbps during peak transfers over the Interconnect.
* Cost and the complexity of the solution should be minimal.
How should you provision the connectivity solution?
- A. Provision a Partner Interconnect through your ISP.
- B. Provision a Dedicated Interconnect instead of a VPN.
- C. Use network compression over your VPN to increase the amount of data you can send over your VPN.
- D. Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
Answer: D
NEW QUESTION 45
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- B. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
- C. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
- D. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
Answer: B
Explanation:
https://link.springer.com/chapter/10.1007/978-1-4842-1004-8_4
NEW QUESTION 46
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command.
Which next hop should you choose?
- A. The IP address of the Cloud VPN gateway
- B. The IP address of the instance on the remote side of the VPN tunnel
- C. The name and region of the Cloud VPN tunnel
- D. The default internet gateway
Answer: C
Explanation:
When you create a route based tunnel using the Cloud Console, Classic VPN performs both of the following tasks: Sets the tunnel's local and remote traffic selectors to any IP address (0.0.0.0/0) For each range in Remote network IP ranges, Google Cloud creates a custom static route whose destination (prefix) is the range's CIDR, and whose next hop is the tunnel. https://cloud.google.com/network-connectivity/docs/vpn/how-to/creating-static-vpns
NEW QUESTION 47
You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours.
Which connectivity method should you choose?
- A. Dedicated Interconnect, but don't provision any VLAN attachments
- B. Dedicated Interconnect with a single VLAN attachment
- C. Cloud VPN
- D. 50-Mbps Partner VLAN attachment
Answer: C
NEW QUESTION 48
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
- B. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
- C. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.
- D. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
Answer: B
NEW QUESTION 49
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
* Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
* The subnetwork logs are not excluded from Stackdriver.
* The instance that is hosting the application can communicate outside the subnet.
* Other instances within the subnet can communicate outside the subnet.
* The external resource initiates communication.
What is the most likely cause of the missing log lines?
- A. The traffic is matching the expected ingress rule.
- B. The traffic is matching the expected egress rule.
- C. The traffic is not matching the expected ingress rule.
- D. The traffic is not matching the expected egress rule.
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION 50
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
- B. Manually patch some of the instances, and then perform a rolling restart on the instance group.
- C. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
- D. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
Answer: C
Explanation:
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups#starting_a_canary_update
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups
NEW QUESTION 51
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Pod
- B. GKE Node
- C. GKE Ingress
- D. GKE Cluster
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig
NEW QUESTION 52
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Tune TCP parameters on the on-premises servers.
- B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- C. Compress files using utilities like tar to reduce the size of data being sent.
- D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/transferring-big-data-sets-to-gcp
NEW QUESTION 53
You create multiple Compute Engine virtual machine instances to be used as TFTP servers.
Which type of load balancer should you use?
- A. TCP proxy load balancer
- B. SSL proxy load balancer
- C. Network load balancer
- D. HTTP(S) load balancer
Answer: C
Explanation:
"TFTP is a UDP-based protocol. Servers listen on port 69 for the initial client-to-server packet to establish the TFTP session, then use a port above 1023 for all further packets during that session. Clients use ports above 1023" https://docstore.mik.ua/orelly/networking_2ndEd/fire/ch17_02.htm Besides, Google Cloud external TCP/UDP Network Load Balancing (after this referred to as Network Load Balancing) is a regional, non-proxied load balancer. Network Load Balancing distributes traffic among virtual machine (VM) instances in the same region in a Virtual Private Cloud (VPC) netw
NEW QUESTION 54
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
- B. Grant the compute.instanceAdmin to your user account.
- C. Grant the iam.serviceAccountUser to your user account.
- D. Grant the read-only privilege to the service account for the Cloud Storage bucket.
Answer: D
NEW QUESTION 55
You want to configure a NAT to perform address translation between your on-premises network blocks and GCP.
Which NAT solution should you use?
- A. An instance with IP forwarding enabled
- B. Cloud NAT
- C. An instance configured with iptables DNAT rules
- D. An instance configured with iptables SNAT rules
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/nat/docs/overview
NEW QUESTION 56
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- A. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone
- B. MANAGED_ZONE
gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE - C. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone
- D. MANAGED_ZONE
Answer: C
Explanation:
Once you have the exported file from your other provider, you can use the gcloud dns record-sets import command to import it into your managed zone.
To import record-sets, you use the dns record-sets import command. The --zone-file-format flag tells importto expect a BIND zone formatted file. If you omit this flag, import expects a YAML-formatted records file.
Reference: https://medium.com/@prashantapaudel/gcp-certification-series-2-4-planning-and-configuring- network-resources-8045ac2cc2ac
NEW QUESTION 57
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale.
How should you provision your instances?
- A. Create a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.
- B. Create an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.
- C. Create a single managed instance group, specify the desired region, and select Multiple zones for the location.
- D. Create an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.
Answer: A
Explanation:
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed- instance-groups
NEW QUESTION 58
You want to use Cloud Interconnect to connect your on-premises network to a GCP VPC. You cannot meet Google at one of its point-of-presence (POP) locations, and your on-premises router cannot run a Border Gateway Protocol (BGP) configuration.
Which connectivity model should you use?
- A. Partner Interconnect with a layer 3 partner
- B. Partner Interconnect with a layer 2 partner
- C. Dedicated Interconnect
- D. Direct Peering
Answer: A
Explanation:
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview For Layer 3 connections, your service provider establishes a BGP session between your Cloud Routers and their edge routers for each VLAN attachment. You don't need to configure BGP on your on-premises router. Google and your service provider automatically set the correct configurations.
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview#connectivity-type
NEW QUESTION 59
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Update the TTL for the zone.
- B. Disable DNSSEC at your domain registrar.
- C. Transfer ownership of the domain to a new registrar.
- D. Set the zone to the TRANSFER state.
Answer: B
Explanation:
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone.
Reference: https://cloud.google.com/dns/docs/dnssec-config
NEW QUESTION 60
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
- B. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- C. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- D. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
Answer: C
NEW QUESTION 61
Your company has launched a mobile application that uploads pictures to google cloud storage bucket. The application was successfully uploading the pictures to google cloud storage buckets, but lately the application has become popular and you start seeing 429 errors. Please suggest the ways to address the issue. Please select any two.
- A. The OAuth access token has expired and needs to be refreshed.
- B. Use truncated exponential backoff
- C. Throttle your client's requests
- D. Use the correct verb with the /upload or /download URLs.
Answer: B
Explanation:
Option A and Option B are the Correct choices because , a 429 error is caused by Too Many Requests.If your application tries to use more than its limit, additional requests will fail. Throttle your client's requests, and/or use truncated exponential backoff.
Option C is Incorrect choice because, a OAuth access token has expiry would result in error
401(Unauthorized)
Option D is Incorrect because, using wrong verb with /upload or /download URLs would lead to
405 (method not allowed error).
NEW QUESTION 62
......
Topics Assessed in Final Test
You can succeed in the actual Google Professional Cloud Network Engineer exam if you manage to demonstrate that you developed the following skills and expertise:
- Implementing and configuring hybrid interconnectivity;
- Gaining knowledge of how to plan, design, and create a GCP network prototype;
- Ensuring network resources optimization.
- Implementing and configuring a Virtual Private Cloud using the GCP network;
- Monitoring and managing network operations;
New Professional-Cloud-Network-Engineer exam dumps Use Updated Google Exam: https://examcollection.prep4king.com/Professional-Cloud-Network-Engineer-latest-questions.html
