Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Questions & Answers

• Question 261:

  You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.

  During troubleshooting you find:

  - Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.

  - The subnetwork logs are not excluded from Stackdriver.

  - The instance that is hosting the application can communicate outside the subnet.

  - Other instances within the subnet can communicate outside the subnet.

  - The external resource initiates communication.

  What is the most likely cause of the missing log lines?

  A. The traffic is matching the expected ingress rule.
  B. The traffic is matching the expected egress rule.
  C. The traffic is not matching the expected ingress rule.
  D. The traffic is not matching the expected egress rule.
  C. The traffic is not matching the expected ingress rule.

• Question 262:

  You are using the gcloud command line tool to create a new custom role in a project by copying a predefined role. You receive this error message: INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid.

  What should you do?

  A. Add the resourcemanager.projects.get permission, and try again.
  B. Try again with a different role with a new name but the same permissions.
  C. Remove the resourcemanager.projects.list permission, and try again.
  D. Add the resourcemanager.projects.setIamPolicy permission, and try again.
  C. Remove the resourcemanager.projects.list permission, and try again.

  ---

  Explanation

  References:

  https://cloud.google.com/iam/docs/understanding-custom-roles

• Question 263:

  You have provisioned a Dedicated Interconnect connection of 20 Gbps with a VLAN attachment of 10 Gbps. You recently noticed a steady increase in ingress traffic on the Interconnect connection from the on-premises data center. You need to ensure that your end users can achieve the full 20 Gbps throughput as quickly as possible.

  Which two methods can you use to accomplish this? (Choose two.)

  A. Configure an additional VLAN attachment of 10 Gbps in another region. Configure the on-premises router to advertise routes with the same multi-exit discriminator (MED).
  B. Configure an additional VLAN attachment of 10 Gbps in the same region. Configure the on-premises router to advertise routes with the same multi-exit discriminator (MED).
  C. From the Google Cloud Console, modify the bandwidth of the VLAN attachment to 20 Gbps.
  D. From the Google Cloud Console, request a new Dedicated Interconnect connection of 20 Gbps, and configure a VLAN attachment of 10 Gbps.
  E. Configure Link Aggregation Control Protocol (LACP) on the on-premises router to use the 20-Gbps Dedicated Interconnect connection.
  B. Configure an additional VLAN attachment of 10 Gbps in the same region. Configure the on-premises router to advertise routes with the same multi-exit discriminator (MED).
  C. From the Google Cloud Console, modify the bandwidth of the VLAN attachment to 20 Gbps.

• Question 264:

  Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue.

  What should you do?

  A. Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
  B. Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
  C. Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
  D. Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
  C. Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.

  ---

  Explanation

  In a hub-and-spoke architecture with hybrid connectivity, subnet routes from the spoke VPCs are not automatically advertised to the on-premises environment. This is because VPC Network Peering does not propagate routes from one VPC to another by default. To resolve this issue: Create a BGP route policy at the Cloud Router in the hub VPC: A BGP route policy ensures that the subnet routes from the VPC spokes, learned via VPC peering, are advertised to the on-premises environment through the hybrid connection. This step is necessary because the Cloud Router only advertises routes explicitly configured in its route policy. Verify subnet route export/import settings in VPC peering: Ensure that the VPC peering connections between the hub and the spokes are configured to allow the import/export of subnet routes as required. By creating and applying a BGP route policy, the subnet routes from the spoke VPCs will be announced to the on-premises router, ensuring proper routing and connectivity in the hybrid architecture.

• Question 265:

  You have a storage bucket that contains the following objects:

  A. Add an appropriate lifecycle rule on the storage bucket.
  B. Issue a cache invalidation command with pattern /folder-a/*.
  C. Make sure that all the objects with prefix folder-a are not shared publicly.
  D. Disable Cloud CDN on the storage bucket. Wait 90 seconds. Re-enable Cloud CDN on the storage bucket.
  B. Issue a cache invalidation command with pattern /folder-a/*.

• Question 266:

  You need to centralize the Identity and Access Management permissions and email distribution for the WebServices Team as efficiently as possible.

  What should you do?

  A. Create a Google Group for the WebServices Team.
  B. Create a G Suite Domain for the WebServices Team.
  C. Create a new Cloud Identity Domain for the WebServices Team.
  D. Create a new Custom Role for all members of the WebServices Team.
  A. Create a Google Group for the WebServices Team.

• Question 267:

  Your on-premises data center has 2 routers connected to GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.

  During troubleshooting you find:

  - Each on-premises router is configured with the same ASN.

  - Each on-premises router is configured with the same routes and priorities.

  - Both on-premises routers are configured with a VPN connected to a single Cloud Router.

  - The VPN logs have no-proposal-chosen lines when the VPNs are connecting.

  - BGP session is not established between one on-premises router and the Cloud Router.

  What is the most likely cause of this problem?

  A. One of the VPN sessions is configured incorrectly.
  B. A firewall is blocking the traffic across the second VPN connection.
  C. You do not have a load balancer to load-balance the network traffic.
  D. BGP sessions are not established between both on-premises routers and the Cloud Router.
  A. One of the VPN sessions is configured incorrectly.

• Question 268:

  You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks.

  What should you do?

  A. Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.
  B. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.
  C. Configure VPC firewall rules to protect the Compute Engine instances against distributed denial-of-service attacks.
  D. Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.
  B. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.

• Question 269:

  You recently deployed Compute Engine instances in regions us-west1 and us-east1 in a Virtual Private Cloud (VPC) with default routing configurations. Your company security policy mandates that virtual machines (VMs) must not have public IP addresses attached to them. You need to allow your instances to fetch updates from the internet while preventing external access.

  What should you do?

  A. Create a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.
  B. Create a single global Cloud NAT gateway and global Cloud Router in the VPC.
  C. Change the instances' network interface external IP address from None to Ephemeral.
  D. Create a firewall rule that allows egress to destination 0.0.0.0/0.
  A. Create a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.

• Question 270:

  Your company has a single on-premises data center that needs to be connected to a VPC in Google Cloud. The total bandwidth requirement is 10Gbps. The connection must be redundant and have a minimum SLA of 99.9%. Due to the sensitive nature of the workloads, you need to implement the solution with the lowest latency.

  What should you do?

  A. Order a 10Gbps Partner Interconnect VLAN attachment. Create a Cloud Router in your Google Cloud VPC.
  B. Order two 10Gbps Dedicated Interconnect connections in a single metropolitan area (metro). Distribute the connections across different edge availability domains. Create a Cloud Router and two 10Gbps VLAN attachments.
  C. Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device that is located on-premises.
  D. Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on different public IPs addresses that are configured on the VPN termination device that is located on-premises.
  B. Order two 10Gbps Dedicated Interconnect connections in a single metropolitan area (metro). Distribute the connections across different edge availability domains. Create a Cloud Router and two 10Gbps VLAN attachments.

  ---

  Explanation

  Dedicated Interconnect: Provides the lowest latency and highest throughput for on-premises connectivity to Google Cloud, which is critical for sensitive workloads.

  Redundancy and SLA: By ordering two Dedicated Interconnect connections in a single metropolitan area and placing them in different edge availability domains, you achieve redundancy and meet the 99.9% SLA requirement.

  Bandwidth: Two 10Gbps connections provide the required 10Gbps bandwidth while ensuring failover capacity.

  Cloud Router and VLAN Attachments: These are needed to manage BGP routing and establish connectivity between your on-premises network and the Google Cloud VPC.