Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Questions & Answers

• Question 301:

  Your organization has implemented Vertex AI online prediction in your Google Cloud environment, which is in the us-central1 region. Online prediction is available through private services access by using the IP CIDR range of 172.16.53.0/24.

  You need to configure access to Vertex AI without affecting the existing routes. You want to use the VLAN attachments that are located in the us-west1 region as primary. The interconnect VLAN attachments in the us-west2 region can only be used as a backup.

  What should you do?

  A. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24.
  B. Create a custom learned route on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
  C. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us- west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
  D. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 200.
  C. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us- west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.

  ---

  Explanation

  To configure access to Vertex AI online prediction (via private services access) while designating a primary and backup region for interconnect VLAN attachments:

  1. Custom route advertisements: Advertise the prefix 172.16.53.0/24 on the VLAN attachments in both us-west1 (primary) and us-west2 (backup) regions. This ensures that the prefix for private services access is known in your on-premises environment.

  2. Set BGP route priority: The BGP priority determines the preferred path for traffic. Assign a lower priority value (e.g., 100) for the primary region (us-west1). Assign a higher priority value (e.g., 200) for the backup region (us-west2). BGP always selects the route with the lowest priority value, ensuring that traffic flows through us-west1 as the primary path. If the us-west1 interconnect becomes unavailable, traffic will automatically fail over to us-west 2.

• Question 302:

  Your organization is using a Shared VPC model. Service project owners want to independently manage their DNS zones in service projects. All service project workloads must be able to resolve all private zones that are defined in other service projects. You need to create a solution that meets these goals.

  What should you do?

  A. Create a Cloud DNS private zone in each service project. Use a Cloud DNS forwarding zone to forward queries to the Shared VPC in the host project.
  B. Create a Cloud DNS private zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
  C. Create a Cloud DNS response policy zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
  D. Create a Cloud DNS private zone in each service project. Use cross-project binding to associate the zones to the Shared VPC in the host project.
  D. Create a Cloud DNS private zone in each service project. Use cross-project binding to associate the zones to the Shared VPC in the host project.

  ---

  Explanation

  Shared VPC and DNS resolution: In a Shared VPC model, the host project manages the network resources (e.g., VPCs), while the service projects contain workloads that use the Shared VPC. For private DNS resolution, DNS zones in service projects must be associated with the Shared VPC. Cross-project binding: Cloud DNS cross-project binding allows private DNS zones created in service projects to be associated with the Shared VPC in the host project. This enables workloads in service projects to resolve private DNS zones independently while sharing the same network. Cross-project binding simplifies DNS management by allowing service project owners to manage their own private DNS zones without requiring direct access to the host project. Workloads resolving all private zones: Using cross-project binding, all workloads in the Shared VPC (across service projects) can resolve private DNS zones defined in other service projects. This ensures full DNS resolution across the organization while maintaining independent DNS management for service project owners.

  This solution meets the requirements of enabling service project owners to independently manage DNS zones while ensuring that all workloads can resolve private zones across the Shared VPC. It aligns with Google Cloud's best practices for Shared VPC and DNS management.

• Question 303:

  Your organization uses a Shared VPC architecture with a host project and three service projects. You have Compute Engine instances that reside in the service projects. You have critical workloads in your on-premises data center. You need to ensure that the Google Cloud instances can resolve on-premises hostnames via the Dedicated Interconnect you deployed to establish hybrid connectivity.

  What should you do?

  A. 1. Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the private zone to the on-premises DNS servers.2. In your Cloud Router, add a custom route advertisement for the IP 35.199.192.0/19 to the on-premises environment.
  B. 1. Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the Private zone to the on-premises DNS servers.2. In your Cloud Router, add a custom route advertisement for the IP 169.254 169.254 to the on-premises environment.
  C. 1. Configure a Cloud DNS private zone in the host project of the Shared VPC.2. Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project.3. In your Cloud Router, add a custom route advertisement for the IP 169.254 169 254 to the on-premises environment.
  D. 1. Configure a Cloud DNS private zone in the host project of the Shared VPC.2. Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project.3. Configure a DNS policy in the Shared VPC to allow inbound query forwarding with your on-premises DNS server as the alternative DNS server.
  A. 1. Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the private zone to the on-premises DNS servers.2. In your Cloud Router, add a custom route advertisement for the IP 35.199.192.0/19 to the on-premises environment.

• Question 304:

  You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.

  Which two methods can you use to accomplish this? (Choose two.)

  A. GetIamPolicy() via REST API
  B. SetIamPolicy() via REST API
  C. gcloud pubsub add-iam-policy-binding $projectname --member user:$username --role roles/editor
  D. gcloud projects add-iam-policy-binding $projectname --member user:$username --role roles/editor
  E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
  D. gcloud projects add-iam-policy-binding $projectname --member user:$username --role roles/editor
  E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.

  ---

  Explanation

  References:

  https://cloud.google.com/iam/docs/granting-changing-revoking-access

• Question 305:

  You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.

  What should you do?

  A. Enable logging on the default Deny Any Firewall Rule.
  B. Enable logging on the VM Instances that receive traffic.
  C. Create a logging sink forwarding all firewall logs with no filters.
  D. Create an explicit Deny Any rule and enable logging on the new rule.
  D. Create an explicit Deny Any rule and enable logging on the new rule.

• Question 306:

  You manage a Cloud NAT gateway for a subnet that contains many virtual machines. Connection usage varies sharply during the day. You need to reduce unused port allocation while still allowing the gateway to scale ports for busy instances.

  What should you enable?

  A. Static port allocation with the minimum ports per VM set to the highest expected value.
  B. Dynamic port allocation on the Cloud NAT gateway.
  C. Endpoint-independent mapping on the Cloud NAT gateway.
  D. Manual NAT IP address allocation with one reserved external IP address.
  B. Dynamic port allocation on the Cloud NAT gateway.

  ---

  Explanation

  Dynamic port allocation lets Cloud NAT allocate ports to VMs based on actual demand instead of reserving a fixed large number of ports for every VM. This helps reduce wasted port capacity while still scaling for instances that need more connections. Static port allocation with a high minimum can over-allocate ports. Endpoint-independent mapping changes how mappings are reused and does not solve variable port allocation. Manual NAT IP allocation controls which NAT IP addresses are used, but it does not by itself dynamically allocate ports per VM.

• Question 307:

  Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from your on-premises network using Cloud Interconnect. You must configure access only to Google APIs and services that are supported by VPC Service Controls through hybrid connectivity with a service level agreement (SLA) in place.

  What should you do?

  A. Configure the existing Cloud Routers to advertise the Google API's public virtual IP addresses.
  B. Use Private Google Access for on-premises hosts with restricted.googleapis.com virtual IP addresses.
  C. Configure the existing Cloud Routers to advertise a default route, and use Cloud NAT to translate traffic from your on-premises network.
  D. Add Direct Peering links, and use them for connectivity to Google APIs that use public virtual IP addresses.
  B. Use Private Google Access for on-premises hosts with restricted.googleapis.com virtual IP addresses.

• Question 308:

  You manage a public Cloud DNS zone for example.com. The security team requires DNS resolvers to validate that responses are signed and have not been altered.

  What should you configure?

  A. Enable DNSSEC for the public managed zone and publish the required DS record with the domain registrar.
  B. Create a private managed zone with the same name and associate it with all VPC networks.
  C. Enable VPC Flow Logs on every subnet that hosts DNS clients.
  D. Configure Cloud CDN signed URLs for the domain.
  A. Enable DNSSEC for the public managed zone and publish the required DS record with the domain registrar.

  ---

  Explanation

  DNSSEC signs DNS records so validating resolvers can verify the authenticity and integrity of DNS responses. For a public zone, the chain of trust also requires publishing the appropriate DS record at the registrar or parent zone. A private managed zone changes internal name resolution but does not provide public DNSSEC validation. VPC Flow Logs observe network flows and do not sign DNS records. Cloud CDN signed URLs authorize content access and are unrelated to DNSSEC.

• Question 309:

  You are establishing a high-throughput, highly reliable, and private network link for a multinational corporation between its on-premises data center in Frankfurt. It is located within a Google-supported co-location facility, and its Google Cloud VPC in the europe-west3 region. You need a connection that supports large-scale data synchronization and real-time application traffic with a bandwidth of 10 Gbps or more.

  What should you do?

  A. Configure a pair of HA VPN tunnels between the on-premises data center and the Google Cloud VPC.
  B. Order a pair of Dedicated Interconnect circuits at the colocation facility to a Google edge location, then configure a VLAN attachment within your Google Cloud VPC.
  C. Implement a Direct Peering connection from your co-location facility to Google's global network edge.
  D. Engage with a Google Cloud Partner to establish a Partner Interconnect connection for your private network.
  B. Order a pair of Dedicated Interconnect circuits at the colocation facility to a Google edge location, then configure a VLAN attachment within your Google Cloud VPC.

  ---

  Explanation

  Dedicated Interconnect is the Google-recommended option for high-throughput private connectivity (10 Gbps and above) when you are in a Google-supported colocation facility. Ordering a redundant pair of Dedicated Interconnect circuits provides high availability, and configuring a VLAN attachment connects the circuits into your VPC in europe-west3 for reliable, private, large-scale data synchronization and real-time traffic.

• Question 310:

  All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.

  What should you do?

  A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
  B. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
  C. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
  D. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
  A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.