Professional-Cloud-Network-Engineer Certification Overview - [Dec 12, 2021] Latest Professional-Cloud-Network-Engineer PDF Dumps
The Best Google Professional-Cloud-Network-Engineer Study Guides and Dumps of 2021
Implement Hybrid Interconnectivity
- Configure Interconnect: This part measures one’s understanding of partner (that is layer 2 versus layer 3 connectivity), bulk storage uploads, and virtualizing with the use of VLAN attachments;
- Configure Cloud Router for Dependability: You will also be expected to demonstrate competence in this domain as well as in the configuration of site-to-site IPsec VPN.
For more info visit:
CCIE to Google Cloud Network Engineer Google cloud network engineer practice exam Google Cloud documentation Google Cloud solutions Security & Identity Fundamentals
How to book Google Professional Cloud Network Engineer Exams
The registration for the Google Professional Cloud Network Engineer Exam follows the steps given below.
- Step 1: Visit the Google Cloud Webassessor Website
- Step 2: Sign in or sign up to your Google Cloud Webassessor account
- Step 3: Search for the exam name Google Professional Cloud Network Engineer
- Step 4: Take the date of the exam, choose exam center and make further payment using payment method like credit/debit etc.
NEW QUESTION 26
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?
- A. Create a custom Google Compute Engine image with your public ssh key embedded.
- B. Upload your public ssh key to each instance Metadata.
- C. Upload your public ssh key to the project Metadata.
- D. Use gcloud compute ssh to automatically copy your public ssh key to the instance.
Answer: C
Explanation:
https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
NEW QUESTION 27
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:
* IP ranges for pods and services must be as small as possible.
* The nodes and the master must not be reachable from the internet.
* You must be able to use kubectl commands from on-premises subnets to manage the cluster.
How should you create the GKE cluster?
- A. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable a GKE cluster network policy, set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - B. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable privateEndpoint on the cluster master.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - C. * Create a VPC-native GKE cluster using GKE-managed IP ranges.
* Set the pod IP range as /21 and service IP range as /24.
* Set up a network proxy to access the master. - D. * Create a private cluster that uses VPC advanced routes.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips
NEW QUESTION 28
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost.
Which two steps should you take? (Choose two.)
- A. Connect the VPCs in project code-dev and data-dev using VPC Network Peering.
- B. Enable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-dev) a service project.
- C. Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
- D. Create a route in the code-dev project to the destination prefixes in project data-dev and use nexthop as the default gateway, and vice versa.
- E. Connect both projects using Cloud VPN.
Answer: A,C
NEW QUESTION 29
You have a web application that is currently hosted in the us-central1 region. Users experience high latency when traveling in Asia. You've configured a network load balancer, but users have not experienced a performance improvement. You want to decrease the latency.
What should you do?
- A. Configure an HTTP load balancer, and direct the traffic to it.
- B. Configure a policy-based route rule to prioritize the traffic.
- C. Configure Dynamic Routing for the subnet hosting the application.
- D. Configure the TTL for the DNS zone to decrease the time between updates.
Answer: A
NEW QUESTION 30
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- B. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
- C. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
- D. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
Answer: B
Explanation:
https://link.springer.com/chapter/10.1007/978-1-4842-1004-8_4
NEW QUESTION 31
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* BGP sessions are established between both on-premises routers and the Cloud Router.
* Only 1 of the on-premises router's routes are being added to the routing table.
What is the most likely cause of this problem?
- A. The ASNs being used on the on-premises routers are different.
- B. A firewall is blocking the traffic across the second VPN connection.
- C. You do not have a load balancer to load-balance the network traffic.
- D. The on-premises routers are configured with the same routes.
Answer: C
NEW QUESTION 32
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?
- A. Shared VPC Admin privileges from the Organization Admin.
- B. Service Project Admin privileges from the Shared VPC Admin.
- C. Organization Admin privileges from the Organization Admin.
- D. Security Admin privileges from the Shared VPC Admin.
Answer: D
Explanation:
A Shared VPC Admin can define a Security Admin by granting an IAM member the Security Admin (compute.securityAdmin) role to the host project. Security Admins manage firewall rules and SSL certificates.
NEW QUESTION 33
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:
IP ranges for pods and services must be as small as possible.
The nodes and the master must not be reachable from the internet.
You must be able to use kubectl commands from on-premises subnets to manage the cluster.
How should you create the GKE cluster?
- A. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable privateEndpoint on the cluster master.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - B. * Create a private cluster that uses VPC advanced routes.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master. - C. * Create a VPC-native GKE cluster using GKE-managed IP ranges.
* Set the pod IP range as /21 and service IP range as /24.
* Set up a network proxy to access the master. - D. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable a GKE cluster network policy, set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks.
Answer: A
Explanation:
Creating GKE private clusters with network proxies for controller access When you create a GKE private cluster with a private cluster controller endpoint, the cluster's controller node is inaccessible from the public internet, but it needs to be accessible for administration. By default, clusters can access the controller through its private endpoint, and authorized networks can be defined within the VPC network. To access the controller from on-premises or another VPC network, however, requires additional steps. This is because the VPC network that hosts the controller is owned by Google and cannot be accessed from resources connected through another VPC network peering connection, Cloud VPN or Cloud Interconnect. https://cloud.google.com/solutions/creating-kubernetes-engine-private-clusters-with-net-proxies
NEW QUESTION 34
You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses.
Which two actions should you take? (Choose two.)
- A. Enable Private Google Access.
- B. Activate the Cloud Datastore API in your project.
- C. Create a custom static route to allow the traffic to reach the Cloud SQL API.
- D. Activate the Service Networking API in your project.
- E. Create a private connection to a service producer.
Answer: D,E
Explanation:
Reference:
https://cloud.google.com/sql/docs/mysql/private-ip
NEW QUESTION 35
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.* Configure the appropriate static routes.
- B. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
- C. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel per subnet.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Create the appropriate static routes.
- D. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
Answer: A
NEW QUESTION 36
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?
- A. Enable logging on the VM Instances that receive traffic.
- B. Create a logging sink forwarding all firewall logs with no filters.
- C. Create an explicit Deny Any rule and enable logging on the new rule.
- D. Enable logging on the default Deny Any Firewall Rule.
Answer: A
NEW QUESTION 37
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
- Each on-premises router is configured with a unique ASN. ?Each on-
premises router is configured with the same routes and priorities.
- Both on-premises routers are configured with a VPN connected to a
single Cloud Router.
- BGP sessions are established between both on-premises routers and the Cloud Router.
- Only 1 of the on-premises router's routes are being added to the
routing table.
What is the most likely cause of this problem?
- A. The ASNs being used on the on-premises routers are different.
- B. A firewall is blocking the traffic across the second VPN connection.
- C. You do not have a load balancer to load-balance the network traffic.
- D. The on-premises routers are configured with the same routes.
Answer: C
NEW QUESTION 38
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments.
* Each organization has enabled full connectivity between all of its projects by using Shared VPC.
* Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
* There are no prefix overlaps between the two organizations.
* Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.
* Neither organization has Interconnects to their on-premises environment.
You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.
Which two steps should you take? (Choose two.)
- A. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC
- B. Set up some variant of DNS forwarding and zone transfers in each organization.
- C. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
- D. Provision Cloud Interconnect to connect both organizations together.
- E. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
Answer: D,E
NEW QUESTION 39
Your company's Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure:
/fr/video
/en/video
/es/video
/../video
/fr/audio
/en/audio
/es/audio
/../audio
Which solution should you recommend?
- A. Rearrange the directory structure, create DNS hostname entries for video and audio and leverage a path rule such as /video/* and /audio/*.
- B. Leave the directory structure as-is, create a URL map and leverage a path rule such as /*/video and /*/ audio.
- C. Leave the directory structure as-is, create a URL map and leverage a path rule such as \/[a-z]{2}\/video and
\/[a-z]{2}\/audio. - D. Rearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio/
*.
Answer: B
NEW QUESTION 40
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service.
What should you do?
- A. Create a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.
- B. Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.
- C. Create IPTables firewall rules that block all traffic except for the traffic-scrubbing service.
- D. Create a VPC Service Control Perimeter that blocks all traffic except for the traffic-scrubbing service.
Answer: A
NEW QUESTION 41
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Ingress
- B. GKE Node
- C. GKE Cluster
- D. GKE Pod
Answer: A
Explanation:
Cloud Armour is applied at load balancers Configuring Google Cloud Armor through Ingress. https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features Security policy features Google Cloud Armor security policies have the following core features: You can optionally use the QUIC protocol with load balancers that use Google Cloud Armor. You can use Google Cloud Armor with external HTTP(S) load balancers that are in either Premium Tier or Standard Tier. You can use security policies with GKE and the default Ingress controller.
NEW QUESTION 42
......
Valid Professional-Cloud-Network-Engineer Exam Updates - 2021 Study Guide: https://www.dumpexams.com/Professional-Cloud-Network-Engineer-real-answers.html
Top Google Professional-Cloud-Network-Engineer Exam Audio Study Guide! Practice Questions Edition: https://drive.google.com/open?id=1ZF08UVO3bRJ53eXKfulpQc9JKEi0oMFA