Google Google Certifications PROFESSIONAL-CLOUD-NETWORK-ENGINEER Questions & Answers

• Question 71:

  You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.

  During troubleshooting you find:

  1.

  Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.

  2.

  The subnetwork logs are not excluded from Stackdriver.

  3.

  The instance that is hosting the application can communicate outside the subnet.

  4.

  Other instances within the subnet can communicate outside the subnet.

  5.

  The external resource initiates communication.

  What is the most likely cause of the missing log lines?

  A. The traffic is matching the expected ingress rule.

  B. The traffic is matching the expected egress rule.

  C. The traffic is not matching the expected ingress rule.

  D. The traffic is not matching the expected egress rule.

  Correct Answer: C

• Question 72:

  One instance in your VPC is configured to run with a private IP address only. You want to ensure that even if this instance is deleted, its current private IP address will not be automatically assigned to a different instance.

  In the GCP Console, what should you do?

  A. Assign a public IP address to the instance.

  B. Assign a new reserved internal IP address to the instance.

  C. Change the instance's current internal IP address to static.

  D. Add custom metadata to the instance with key internal-address and value reserved.

  Correct Answer: C

  Since here https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address#reservenewip it is written that "automatically allocated or an unused address from an existing subnet".

• Question 73:

  Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node Which Pod per node CIDR range should you use?

  A. /24

  B. /25

  C. /26

  D. /28

  Correct Answer: B

  To determine the Pod per node CIDR range, you need to calculate how many IP addresses are required for each node, and then choose the smallest CIDR range that can accommodate that number. A CIDR range of /n means that there are 2^(32-n) IP addresses available in that range. For example, a /24 range has 2^(32-24) = 256 IP addresses. According to the question, the application team requires a minimum of 60 Pods per node and a maximum of 100 Pods per node. Therefore, you need to choose a CIDR range that can provide at least 100 IP addresses per node, but not more than necessary. A /25 range has 2^(32-25) = 128 IP addresses, which is enough for 100 Pods per node. A /26 range has 2^(32-26) = 64 IP addresses, which is not enough for 60 Pods per node. A /24 range has 256 IP addresses, which is more than needed and wastes IP address space. A /28 range has 2^(32-28) = 16 IP addresses, which is far too small for any node. Therefore, the best option is B. /25. This is also consistent with the Google Kubernetes Engine documentation, which states that each node is allocated a /24 range of IP addresses for Pods by default, but the maximum number of Pods per node is 1101. This means that there are approximately twice as many available IP addresses as possible Pods, which is similar to the ratio of 128 to 100 in the /25 range.

  1: Configure maximum Pods per node | Google Kubernetes Engine (GKE) | Google Cloud

• Question 74:

  You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket, You are using the VSE ORIG.-X_NZADERS cache mode You receive an HTTP 403 error when opening the file In your browser and you see that the HTTP response has a Cache-control: private, max-age=O header How should you correct this Issue?

  A. Configure a Cloud Storage bucket permission that gives the Storage Legacy Object Reader role

  B. Change the cache mode to cache all content.

  C. Increase the default time-to-live (TTL) for the backend service.

  D. Enable negative caching for the backend bucket

  Correct Answer: A

  The correct answer is A. Configure a Cloud Storage bucket permission that gives the Storage Legacy Object Reader role.

  This answer is based on the following facts:

  Cloud CDN can serve private content from Cloud Storage buckets, but you need to grant the appropriate permissions to the Google-managed service account that represents your load balancer1.

  The Storage Legacy Object Reader role grants read access to objects in a bucket2.

  The Cache-control: private header indicates that the object is not publicly readable and requires authentication3.

  The USE_ORIGIN_HEADERS cache mode instructs Cloud CDN to cache responses based on the Cache-Control and Expires headers from the origin server4. Changing the cache mode, increasing the TTL, or enabling negative caching will

  not affect the 403 error.

• Question 75:

  You built a web application with several containerized microservices. You want to run those microservices on Cloud Run. You must also ensure that the services are highly available to your customers with low latency. What should you do?

  A. Deploy the Cloud Run services to multiple availability zones. Create a global TCP load balancer. Add the Cloud Run endpoints to its backend service.

  B. Deploy the Cloud Run services to multiple regions. Create serverless network endpoint groups (NEGs) that point to the services. Create a global HTTPS load balancer, and attach the serverless NEGs as backend services of the load balancer.

  C. Deploy the Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTPS load balancer, and attach the Cloud Endpoints to its backend

  D. Deploy the Cloud Run services to multiple regions. Configure a round-robin A record in Cloud DNS.

  Correct Answer: B

• Question 76:

  Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.

  How should you design this topology?

  A. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.

  B. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.

  C. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.

  D. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

  Correct Answer: D

  https://cloud.google.com/vpc/docs/using-vpc#create-auto-network We create one VPC network in auto mode that creates one subnet in each Google Cloud region automatically. So, region us-east1 and europe-west1 are in the same network and they can communicate using their internal IP address even though they are in different Regions. They take advantage of Google's global fiber network.

• Question 77:

  You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.

  What should you do?

  A. Upload your public ssh key to the project Metadata.

  B. Upload your public ssh key to each instance Metadata.

  C. Create a custom Google Compute Engine image with your public ssh key embedded.

  D. Use gcloud compute ssh to automatically copy your public ssh key to the instance.

  Correct Answer: A

  Overview By creating and managing SSH keys, you can let users access a Linux instance through third-party tools. An SSH key consists of the following files: A public SSH key file that is applied to instance-level metadata or project-wide metadata. A private SSH key file that the user stores on their local devices. If a user presents their private SSH key, they can use a third-party tool to connect to any instance that is configured with the matching public SSH key file, even if they aren't a member of your Google Cloud project. Therefore, you can control which instances a user can access by changing the public SSH key metadata for one or more instances. https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#addkey

• Question 78:

  Your organization's security policy requires that all internet-bound traffic return to your on-premises data center through HA VPN tunnels before egressing to the internet, while allowing virtual machines (VMs) to leverage private Google APIs

  using private virtual IP addresses 199.36.153.4/30. You need to configure the routes to enable these traffic flows.

  What should you do?

  A. Configure a custom route 0.0.0.0/0 with a priority of 500 whose next hop is the default internet gateway. Configure another custom route 199.36.153.4/30 with priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.

  B. Configure a custom route 0.0.0.0/0 with a priority of 1000 whose next hop is the internet gateway. Configure another custom route 199.36.153.4/30 with a priority of 500 whose next hop is the VPN tunnel back to the on-premises data center.

  C. Announce a 0.0.0.0/0 route from your on-premises router with a MED of 1000. Configure a custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the default internet gateway.

  D. Announce a 0.0.0.0/0 route from your on-premises router with a MED of 500. Configure another custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.

  Correct Answer: A

• Question 79:

  You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider.

  Which connection type should you choose?

  A. Carrier Peering

  B. Direct Peering

  C. Dedicated Interconnect

  D. Partner Interconnect

  Correct Answer: B

  When established, Direct Peering provides a direct path from your on-premises network to Google services, including Google Cloud products that can be exposed through one or more public IP addresses. Traffic from Google's network to your on-premises network also takes that direct path, including traffic from VPC networks in your projects. Google Cloud customers must request that direct egress pricing be enabled for each of their projects after they have established Direct Peering with Google. For more information, see Pricing.

  Reference: https://cloud.google.com/interconnect/docs/how-to/direct-peering

• Question 80:

  You need to create the network infrastructure to deploy a highly available web application in the us-east1 and us-west1 regions. The application runs on Compute Engine instances, and it does not require the use of a database. You want to follow Google-recommended practices. What should you do?

  A. Create one VPC with one subnet in each region. Create a regional network load balancer in each region with a static IP address. Enable Cloud CDN on the load balancers. Create an A record in Cloud DNS with both IP addresses for the load balancers.

  B. Create one VPC with one subnet in each region. Create a global load balancer with a static IP address. Enable Cloud CDN and Google Cloud Armor on the load balancer. Create an A record using the IP address of the load balancer in Cloud DNS.

  C. Create one VPC in each region, and peer both VPCs. Create a global load balancer. Enable Cloud CDN on the load balancer. Create a CNAME for the load balancer in Cloud DNS.

  D. Create one VPC with one subnet in each region. Create an HTTP(S) load balancer with a static IP address. Choose the standard tier for the network. Enable Cloud CDN on the load balancer. Create a CNAME record using the load balancer's IP address in Cloud DNS.

  Correct Answer: C