Professional-Cloud-Network-Engineer Exam Training Practice Tests (Google Cloud Certified

Question 1

You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial- of-service and application layer (layer 7) attacks. What should you do?

A. Configure VPC firewall rules to protect the Compute Engine instances against distributed denial- of-service attacks. B. Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level. C. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application. D. Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are
100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?

A. Remove the -m flag from the gsutil command to enable single-threaded transfers. B. Compress files using utilities like tar to reduce the size of data being sent. C. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME]. D. Tune TCP parameters on the on-premises servers.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

Your organization wants to deploy an internal application named app-1 in VPC-1. The application will consume services from another internal application named app-2 in VPC-2. VPC Network Peering will connect both applications. You need to apply microsegmentation between these two applications and VPCs. What should you do?

A. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-
2. Configure a network firewall policy that is attached to VPC-2 with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule. B. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure an ingress VPC firewall rule that allows traffic from secure-tag-app-1 to secure- tag-app-2. Leave the default deny ingress rule and the default allow egress rule. C. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-
2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag- app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule. D. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure- tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

Your organization has a Google Cloud Virtual Private Cloud (VPC) with subnets in us-east1, us- west4, and europe-west4 that use the default VPC configuration. Employees in a branch office in Europe need to access the resources in the VPC using HA VPN. You configured the HA VPN associated with the Google Cloud VPC for your organization with a Cloud Router deployed in europe-west4. You need to ensure that the users in the branch office can quickly and easily access all resources in the VPC.
What should you do?

A. Configure the VPC dynamic routing mode to Global. B. Create custom advertised routes for each subnet. C. Configure each subnet's VPN connections to use Cloud VPN to connect to the branch office. D. Set the advertised routes to Global for the Cloud Router.

Correct Answer: A

Question 5

You want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN. You need to restrict reachability over the tunnel to specific local subnets, and you do not have a device capable of speaking Border Gateway Protocol (BGP).
Which routing option should you choose?

A. Policy-based routing using a custom local traffic selector B. Route-based routing using default traffic selectors C. Policy-based routing using the default local traffic selector D. Dynamic routing using Cloud Router

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?

A. Grant the read-only privilege to the service account for the Cloud Storage bucket. B. Grant the iam.serviceAccountUser to your user account. C. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket. D. Grant the compute.instanceAdmin to your user account.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Your organization is migrating workloads from AWS to Google Cloud. Because a particularly critical workload will take longer to migrate, you need to set up Google Cloud CDN and point it to the existing application at AWS. What should you do?

A. Create a hybrid NEG that points to the existing IP of the application.
Map the NEG to a passthrough Network Load Balancer as a target pool.
Enable Cloud CDN on the target pool. B. Create a hybrid NEG that points to the existing IP of the application.
Map the NEG to an Application Load Balancer as a backend service.
Enable Cloud CDN on the backend service. C. Create an internet NEG that points to the existing FQDN of the application.
Map the NEG to an Application Load Balancer as a backend service.
Enable Cloud CDN on the backend service. D. Create an internet NEG that points to the existing FQDN of the application.
Map the NEG to a passthrough Network Load Balancer as a backend service.
Enable Cloud CDN on the backend service.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider.
Which connection type should you choose?

A. Carrier Peering B. Partner Interconnect C. Direct Peering D. Dedicated Interconnect

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

Your organization has five different VPCs across different projects in y our Google Cloud organization that need high-throughput connectivity. You have performed an audit of the IP address utilization in each VPC, and there are two overlapping subnets that are used by two of the VPCs: 240.0.0.0/16 and 240.128.0.0/24. You have confirmed that no Class E subnets (240.0.0.0/4) will require inter-VPC connectivity, but all other subnets in the VPCs will need connectivity. You need to deploy a Google Cloud routing solution to meet the connectivity requirements. What should you do?

A. Create a series of multiple network interface VMs with an interface in each VPC. Place the VMs in an instance group. Create an internal passthrough Network Load Balancer in each VPC with the backend of the instance group. Configure custom static routes in each VPC with the next hop of the respective load balancer. Add Cloud network firewall policy rules to allow traffic. B. Create a full mesh of VPC Network Peering connections between all five VPCs. Make sure not to import or export subnet routes with public IP addresses. Add Cloud network firewall policy rules to allow traffic. C. Create a full mesh of VPC Network Peering connections between all five VPCs with an export exclude filter for 240.0.0.0/4 on every side. Add Cloud network firewall policy rules to allow traffic. D. Create a Network Connectivity Center hub with a mesh topology. Add a VPC spoke for each of the five VPCs and configure an export exclude filter for 240.0.0.0/4. Add Cloud network firewall policy rules to allow traffic.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary.
You want to allocate the minimum number of Pod IP addresses.
Which subnet mask should you use for the Pod IP address range?

A. /21 B. /25 C. /23 D. /22

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 11

You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules.
- Always allow Secure Shell (SSH) from your corporate IP address.
- Restrict SSH access from all other IP addresses.
There are multiple projects and VPCs in your Google Cloud organization.
You need to ensure that other VPC firewall rules cannot bypass the security team's requirements.
What should you do?

A. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0.
Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1. B. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1.
Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0. C. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0.
Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1. D. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1 Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.

Correct Answer: A

Question 12

Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from your on-premises network using Cloud Interconnect. You must configure access only to Google APIs and services that are supported by VPC Service Controls through hybrid connectivity with a service level agreement (SLA) in place. What should you do?

A. Configure the existing Cloud Routers to advertise a default route, and use Cloud NAT to translate traffic from your on-premises network. B. Add Direct Peering links, and use them for connectivity to Google APIs that use public virtual IP addresses. C. Use Private Google Access for on-premises hosts with restricted.googleapis.com virtual IP addresses. D. Configure the existing Cloud Routers to advertise the Google API's public virtual IP addresses.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 13

You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?

A. Create one OpenVPN Access Server in each region of your VPC and your partner's VPC.
Connect your servers to the partner's servers. B. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC.
Create one OpenVPN Access Server in each region of your partner's VPC.
Connect your VPN gateway to your partner's servers. C. Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VPC.
Connect your VPN gateways to the partner's gateways.
Enable global dynamic routing in each VPC. D. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC.
Connect your VPN gateways to the partner's gateways with a pair of tunnels.
Enable global dynamic routing in each VPC.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 14

Your product team has web servers running on both us-east1 and us-west1 regions in the prod- servers project. Your security team plans to install an intrusion detection system (IDS) in their own Google Cloud project to inspect the incoming network traffic. What should you do?

A. Create a host project and a Shared VPC for the security team.
Make prod-servers a service project, and relocate the web servers to shared subnets in both regions.
Create an internal load balancer and the IDS system in a subnet in either us-east1 or us-west1.
Enable Packet Mirroring, and create a packet mirroring policy inside the host project. B. Create a host project and a Sharad VPC for the security team.
Make prod-servers a service project, and relocate the web servers to shared subnets in both regions.
Enable IP forwarding on all the web servers.
Create the IDS system in a non-shared subnet of us-east1 or us-west1.
Configure the web servers to forward the packets to the IDS system. C. Create a new project and a VPC for the security team.
Peer the new VPC with the web servers' VPC in the prod-servers project.
Create an internal load balancer and the IDS system in both us-east1 and us-west1.
Enable Packet Mirroring, and create packet mirroring policies inside the new project. D. Create a new project and a VPC for the security team.
Peer the new VPC with the web servers' VPC in the prod-servers project.
Enable IP forwarding on all the web servers.
Install the IDS system in both us-east1 and us-west1.
Configure the web servers to forward the packets to the IDS system.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Google Cloud Certified - Professional Cloud Network Engineer - Professional-Cloud-Network-Engineer Exam Practice Test