Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Questions & Answers

• Question 311:

  You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.

  What should you do?

  A. Update the TTL for the zone.
  B. Set the zone to the TRANSFER state.
  C. Disable DNSSEC at your domain registrar.
  D. Transfer ownership of the domain to a new registrar.
  C. Disable DNSSEC at your domain registrar.

  ---

  Explanation

  Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone.

  References:

  https://cloud.google.com/dns/docs/dnssec-config

• Question 312:

  You are implementing firewall controls to protect your compute resources in a newly created VPC. To make the protection process easier to manage and control, you've defined the hierarchical firewall policies, global network firewall policies, and VPC firewall rules. The configuration of rules defines the following characteristics: The hierarchical firewall policy, bound at the organization level, is allowing/denying specific external traffic. There is a global network firewall policy with rules that enforce intrusion prevention system (IPS) capabilities for specific external inbound/outbound traffic. The VPC firewall rules allow internal communication from RFC 1918 defined subnets communications. The VPC firewall contains an explicit deny rule with logs enabled. This configuration was successful in multiple preexisting VPCs. However, you noticed that the logs were missing when you were reviewing a newly created VPC. All external communications are hanging, but internal traffic is working as expected. You want to fix the connectivity issue.

  What should you do?

  A. Create a new VPC and migrate existing resources to the new VPC. Delete the old VPC, and reapply the firewall policies and rules in the new VPC.
  B. Raise the priority numbers of the firewall policy rules and lower the priority numbers of the VPC firewall rules.
  C. Review the order in which the VPC firewall rules and policies are evaluated. If the VPC firewall rules are being evaluated before firewall policies, switch the order.
  D. Lower the priority numbers of the firewall policy rules and raise the priority numbers of the VPC firewall rules.
  C. Review the order in which the VPC firewall rules and policies are evaluated. If the VPC firewall rules are being evaluated before firewall policies, switch the order.

  ---

  Explanation

  Firewall policies and rules in Google Cloud are evaluated in a specific order, and misconfiguration in their evaluation order can cause unexpected behavior, such as blocking or allowing unintended traffic. Hierarchical firewall policies (bound at the organization or folder level) are evaluated before global network firewall policies and VPC firewall rules. In this case, it appears that the hierarchical firewall policy or global firewall policy is denying traffic before the VPC firewall rules are even evaluated, which is why all external communications are failing, and logs for the explicit deny rule in the VPC firewall are missing. To fix this issue, you need to ensure the correct evaluation order of policies and rules:

  1. Hierarchical firewall policies are evaluated first.

  2. Global network firewall policies are evaluated next.

  3. VPC firewall rules are evaluated last.

  Switching the order to ensure the correct hierarchy resolves the issue while maintaining the existing configuration.

• Question 313:

  Your company has workloads in several VPC networks and an on-premises data center connected by Cloud Interconnect. On-premises clients must privately reach a set of Google APIs through a specific internal endpoint that you control, and the endpoint must be reachable over the hybrid connection.

  What should you configure?

  A. Private Google Access on every subnet and a default route from on-premises to the internet gateway.
  B. A Private Service Connect endpoint for Google APIs, DNS records that resolve the APIs to the endpoint, and route advertisements for the endpoint range.
  C. A VPC Network Peering connection from the on-premises network to the Google API producer network.
  D. Cloud NAT on the VPC subnet and a public DNS override for the Google API hostnames.
  B. A Private Service Connect endpoint for Google APIs, DNS records that resolve the APIs to the endpoint, and route advertisements for the endpoint range.

  ---

  Explanation

  Private Service Connect for Google APIs lets you create private endpoints for supported Google APIs in a VPC network and control DNS so clients resolve API names to those endpoint IP addresses. For hybrid clients, the endpoint routes must be advertised or otherwise reachable over the Interconnect path. Private Google Access applies to VM access from subnets and does not create a controllable endpoint for on-premises clients by itself. VPC Network Peering is not established directly with on-premises networks. Cloud NAT provides outbound internet NAT and does not provide private Google API endpoints.

• Question 314:

  Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.

  How should you design this topology?

  A. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
  B. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
  C. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
  D. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
  D. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

  ---

  Explanation

  VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.

  References:

  https://cloud.google.com/vpc/docs/vpc-peering

• Question 315:

  You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution.

  What should you do?

  A. Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways. Enable global dynamic routing in each VPC.
  B. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner's VPC. Connect your VPN gateway to your partner's servers.
  C. Create one OpenVPN Access Server in each region of your VPC and your partner's VPC. Connect your servers to the partner's servers.
  D. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways with a pair of tunnels. Enable global dynamic routing in each VPC.
  D. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways with a pair of tunnels. Enable global dynamic routing in each VPC.

• Question 316:

  You are designing a hub-and-spoke network architecture for your company's cloud-based environment. You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access. The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5.

  What should you do?

  A. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5.2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.3. Export the custom routes in the hub.4. Import the custom routes in the spokes.
  B. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5.2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.3. Export the custom routes in the hub. Import the custom routes in the spokes.4. Delete the default internet gateway route of the spokes.
  C. 1. Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances.2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.3. Export the custom routes in the hub. Import the custom routes in the spokes.
  D. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5.2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.3. Create a new route in the spoke VPC that points to IP address 10.0.0.5.
  B. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5.2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.3. Export the custom routes in the hub. Import the custom routes in the spokes.4. Delete the default internet gateway route of the spokes.

• Question 317:

  You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload.

  Which type of load balancer should you use?

  A. HTTP(S) load balancer
  B. Network load balancer
  C. Internal load balancer
  D. TCP/SSL proxy load balancer
  D. TCP/SSL proxy load balancer

• Question 318:

  Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with on-premises connectivity already in place. You are deploying a new application using Google Kubernetes Engine (GKE), which must be accessible only from the same VPC network and on-premises locations. You must ensure that the GKE control plane is exposed to a predefined list of on-premises subnets through private connectivity only.

  What should you do?

  A. Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.
  B. Create a GKE private cluster with a public endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.
  C. Create a GKE private cluster with a private endpoint for the control plane. Configure authorized networks to specify the desired on-premises subnets.
  D. Create a GKE public cluster. Configure authorized networks to specify the desired on-premises subnets.
  A. Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.

• Question 319:

  You configured an external Application Load Balancer with backends in a managed instance group. Health checks are failing, but the application responds locally on the backend port. You suspect the firewall configuration is blocking probes.

  Which source ranges should you allow to the backend health check port?

  A. 35.191.0.0/16 and 130.211.0.0/22.
  B. 10.128.0.0/9 and 172.16.0.0/12.
  C. 8.8.8.8/32 and 8.8.4.4/32.
  D. 199.36.153.4/30 only.
  A. 35.191.0.0/16 and 130.211.0.0/22.

  ---

  Explanation

  Google Cloud load balancer health checks use documented probe source ranges, including 35.191.0.0/16 and 130.211.0.0/22 for many load balancing configurations. Backend firewall rules must allow the health check protocol and port from the required probe ranges. RFC 1918 ranges do not represent Google health check probes. Google Public DNS IP addresses are not health check probe ranges. 199.36.153.4/30 is the restricted Google APIs VIP range and is unrelated to load balancer health checks.

• Question 320:

  You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision.

  What should you do?

  A. Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.
  B. Use Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.
  C. Configure VPC Flow Logs. Review the logs by filtering on the source and destination.
  D. Configure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.
  A. Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.