Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Questions & Answers

• Question 121:

  Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.

  Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)

  A. VPC peering
  B. Shared VPC
  C. Cloud VPN
  D. Dedicated Interconnect
  E. Cloud NAT
  A. VPC peering
  C. Cloud VPN

• Question 122:

  You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.

  How should you configure the health check?

  A. Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
  B. Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
  C. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
  D. Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.
  C. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.

• Question 123:

  You are doing a canary test for a new version of an online retailer's main application, called app-v2, which is configured as a separate backend service from the current version, app-v1. You need to direct 10% of the traffic for the path /shop to app-v2 and direct the remaining 90% to app-v1. The app-v2 service supports calls on both /shop/v2 and /shop, and the app-v1 service only supports calls on /shop. You need to implement the most efficient solution to achieve this traffic split and path rewrite.

  What should you do?

  A. - Create a path rule for /shop in the URL map. - Configure its route action with weightedBackendServices to split traffic 90% to app-v1 and 10% to app-v2.
  B. - Create a single URL map rule for the /shop path. - In the rule's route action, configure weightedBackendServices to split traffic 90/10 between app-v1 and app-v2. - Configure a urlRewrite to change the path to /shop/v2.
  C. - Create two URL map rules with the same /shop path. - Configure the first rule with a higher priority to route traffic to app-v2, and perform a urlRewrite to /shop/v2. - Configure the second rule with a lower priority to route traffic to app-v1 without a rewrite.
  D. - Create two separate route rules in the URL map. - The first rule, with a higher priority, matches traffic based on a specific HTTP header and routes it to app-v2 with a URL. - The second rule, with a lower priority, routes all other traffic to app-v1.
  A. - Create a path rule for /shop in the URL map. - Configure its route action with weightedBackendServices to split traffic 90% to app-v1 and 10% to app-v2.

  ---

  Explanation

  Use one URL map path rule for /shop and configure routeAction.weightedBackendServices to send 90% of traffic to app-v1 and 10% to app-v2. Google Cloud URL maps support weighted traffic splitting within a single matching rule, and you cannot create multiple path rules for the exact same path to split traffic that way. A rewrite is not needed here because app-v2 already supports requests on /shop, so the single weighted path rule is the most efficient solution.

  References:

  https://docs.cloud.google.com/load-balancing/docs/url-map-concepts

  https://docs.cloud.google.com/compute/docs/reference/rest/v1/urlMaps/update

• Question 124:

  Your company's cloud network has hybrid connectivity to an on-premises environment through Cloud Interconnect in two regions (us-east4 and us-west1). You received complaints that some on-premises destinations are no longer reachable from us-east4, after changes were made to advertise additional routes to us-west1. You need to troubleshoot to see if any routes were dropped.

  What should you do?

  A. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the global routing_mode metric attribute.
  B. Query the dynamic_routes/learned_routes/unique_destinations_limit metric and review the global routing_mode metric attribute.
  C. Query the dynamic_routes/learned_routes/any_dropped_unique_destinations metric and review the regional routing_mode metric attribute.
  D. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the regional routing_mode metric attribute.
  A. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the global routing_mode metric attribute.

  ---

  Explanation

  Query the dynamic_routes/learned_routes/dropped_unique_destinations metric: This metric provides information about the number of unique routes that were dropped, helping you identify whether route limits have been exceeded. Review the global routing_mode metric attribute: If global routing mode is enabled, it allows the routes learned in one region to be used in another. Reviewing the global routing mode ensures that the route advertisements and limits are correctly applied across regions.

• Question 125:

  Your organization has a new security policy that requires you to monitor all egress traffic payloads from your virtual machines in region us-west2. You deployed an intrusion detection system (IDS) virtual appliance in the same region to meet the new policy. You now need to integrate the IDS into the environment to monitor all egress traffic payloads from us-west2.

  What should you do?

  A. Enable firewall logging, and forward all filtered egress firewall logs to the IDS.
  B. Enable VPC Flow Logs. Create a sink in Cloud Logging to send filtered egress VPC Flow Logs to the IDS.
  C. Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.
  D. Create an internal HTTP(S) load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.
  C. Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

• Question 126:

  Your company deployed a hub and spoke architecture in Google Cloud to host their workloads. They use VPC network peerings to connect the hub and the spokes. You need to replicate the design and use Network Connectivity Center.

  What should you do?

  A. Choose a Network Connectivity Center star topology. Deploy the hub VPC in the center group. Deploy the spoke VPCs in the edge group.
  B. Choose a Network Connectivity Center star topology. Deploy the spoke VPCs in the center group. Deploy the hub VPC in the edge group.
  C. Choose a Network Connectivity Center mesh topology. Configure the hub and the spokes as Network Connectivity Center spokes.
  D. Choose a Network Connectivity Center mesh topology. Configure the spokes as Network Connectivity Center spokes.
  A. Choose a Network Connectivity Center star topology. Deploy the hub VPC in the center group. Deploy the spoke VPCs in the edge group.

  ---

  Explanation

  Hub VPC: Acts as the central point of connectivity and is deployed in the center group of the NCC. This ensures that the hub can manage and route traffic between the spoke VPCs efficiently.

  Spoke VPCs: Are deployed in the edge group of the NCC, connecting to the central hub VPC. This setup mirrors the traditional hub-and-spoke architecture and provides centralized management of connectivity, ensuring scalability and ease of control.

• Question 127:

  You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.

  What should you do?

  A. Ensure that the object you don't want to be cached anymore is not shared publicly.
  B. Create a new storage bucket, and move the object you don't want to be cached anymore inside it. Then edit the bucket setting and enable the private attribute.
  C. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
  D. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
  D. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.

• Question 128:

  Your company has a web application, app.example.com, hosted on a Compute Engine instance within a Google Cloud VPC. You need to configure DNS so that employees inside the VPC resolve app.example.com to its private IP address, while external users on the internet resolve the same hostname to a public IP address managed by a global external HTTPS Application Load Balancer. Your solution needs to follow Google-recommended practices.

  What should you do?

  A. Use a Cloud DNS forwarding zone to send all queries for app.example.com from your VPC to an on-premises DNS server that holds the private record.
  B. Create a single public Cloud DNS zone for app.example.com. Add two 'A' records with the same hostname: one for the public IP and one for the private IP, relying on DNS round-robin.
  C. Use Cloud DNS split horizon to create two Cloud DNS zones for app.example.com: a public zone for the public IP and a VPC-authorized private zone for the private IP.
  D. Create a private Cloud DNS zone for app.example.com, and use a Cloud NAT gateway to translate the private IP to a public IP for external users.
  C. Use Cloud DNS split horizon to create two Cloud DNS zones for app.example.com: a public zone for the public IP and a VPC-authorized private zone for the private IP.

  ---

  Explanation

  Google-recommended practice for serving the same hostname differently to internal and external clients is Cloud DNS split horizon. Create a public zone for app.example.com that returns the load balancer's public IP to internet users, and create a private zone for the same name, authorized to the VPC, that returns the internal private IP for employees inside the VPC. This lets the same FQDN resolve differently based on where the query originates.

  References:

  https://docs.cloud.google.com/dns/docs/zones/zones-overview

  https://docs.cloud.google.com/dns/docs/dns-overview

  https://docs.cloud.google.com/architecture/best-practices-vpc-design

• Question 129:

  You configured a single IPSec Cloud VPN tunnel for your organization to a third-party customer. You confirmed that the VPN tunnel is established. However, the BGP session status states that the BGP is not configured. The customer has provided you with their BGP settings: Local BGP address: 169.254.11.1/30 Local ASN: 64515 Peer BGP address: 169.254.11.2 Peer ASN:

  64517 Base MED: 1000 MD5 Authentication: Disabled.

  You need to configure the local BGP session for this tunnel based on the settings provided by the customer. You already associated the Cloud Router with the Cloud VPN Tunnel.

  What settings should you use for the BGP session?

  A. Peer ASN: 64517 Advertised Route Priority (MED): 100 Local BGP IP: 169.254.11.2 Peer BGP IP: 169.254.11.1 MD5 Authentication: Disabled
  B. Peer ASN: 64515 Advertised Route Priority (MED): 100 Local BGP IP: 169.254.11.1 Peer BGP IP: 169.254.11.2 MD5 Authentication: Disabled
  C. Peer ASN: 64515 Advertised Route Priority (MED): 100 Local BGP IP: 169.254.11.2 Peer BGP IP: 169.254.11.1 MD5 Authentication: Disabled
  D. Peer ASN: 64515 Advertised Route Priority (MED): 1000 Local BGP IP: 169.254.11.2 Peer BGP IP: 169.254.11.1 MD5 Authentication: Enabled
  A. Peer ASN: 64517 Advertised Route Priority (MED): 100 Local BGP IP: 169.254.11.2 Peer BGP IP: 169.254.11.1 MD5 Authentication: Disabled

  ---

  Explanation

  To configure the BGP session correctly, you must match the settings provided by the customer and ensure the configuration is reversed when setting up the session on your side:

  Local BGP IP and Peer BGP IP:

  The customer's local BGP IP (169.254.11.1) becomes your peer BGP IP. The customer's peer BGP IP (169.254.11.2) becomes your local BGP IP. Local ASN and Peer ASN: The customer's local ASN (64515) becomes your peer ASN. The customer's peer ASN (64517) becomes your local

  ASN. Advertised Route Priority (MED): MED provided by the customer is 1000, but this setting is not directly required for the configuration since Google Cloud BGP MED defaults to 100, and it's not explicitly specified to override this.

  MD5 Authentication: MD5 Authentication is disabled according to the customer's settings, so it should not be enabled. This configuration ensures that the BGP session settings match the customer's expectations and establishes the session successfully.

• Question 130:

  You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.

  How should you design this topology?

  A. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
  B. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
  C. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
  D. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.
  A. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.