[Apr-2024] Google Professional-Cloud-Network-Engineer Exam: Basic Questions With Answers
New 2024 Realistic Free Google Professional-Cloud-Network-Engineer Exam Dump Questions and Answer
Google Professional-Cloud-Network-Engineer certification is an excellent way for network engineers and architects to demonstrate their proficiency in cloud networking and gain recognition from the industry. Achieving this certification helps professionals to differentiate themselves from their peers and opens up new career opportunities. It also helps professionals to gain credibility with clients and employers, who recognize the value of cloud networking skills and expertise.
Topics Assessed in Final Test
You can succeed in the actual Google Professional Cloud Network Engineer exam if you manage to demonstrate that you developed the following skills and expertise:
- Discerning how to configure network services;
- Implementing and configuring a Virtual Private Cloud using the GCP network;
- Ensuring network resources optimization.
NEW QUESTION # 20
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
- B. Add a Cache-Controlentry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
- C. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the privateattribute.
- D. Ensure that the object you don't want to be cached anymore is not shared publicly.
Answer: D
Explanation:
Explanation/Reference: https://developers.google.com/web/ilt/pwa/caching-files-with-service-worker
NEW QUESTION # 21
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Update the TTL for the zone.
- B. Disable DNSSEC at your domain registar.
- C. Transfer ownership of the domain to a new registar.
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone. - D. Set the zone to the TRANSFER state.
Answer: B
NEW QUESTION # 22
You have enabled HTTP(S) load balancing for your application, and your application developers have reported that HTTP(S) requests are not being distributed correctly to your Compute Engine Virtual Machine instances. You want to find data about how the request are being distributed.
Which two methods can accomplish this? (Choose two.)
- A. In Stackdriver Monitoring, select Resources > Metrics Explorer and search for https/request_bytes_count metric.
- B. On the Load Balancer details page of the GCP Console, click on the Monitoring tab, select your backend service, and look at the graphs.
- C. In Stackdriver Monitoring, create a new dashboard and track the https/backend_request_count metric for the load balancer.
- D. In Stackdriver Error Reporting, look for any unacknowledged errors for the Cloud Load Balancers service.
- E. In Stackdriver Monitoring, select Resources > Google Cloud Load Balancers and review the Key Metrics graphs in the dashboard.
Answer: B,C
NEW QUESTION # 23
You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision. What should you do?
- A. Configure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.
- B. Configure VPC Flow Logs. Review the logs by filtering on the source and destination.
- C. Use Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.
- D. Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.
Answer: C
NEW QUESTION # 24
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users.
What should you do?
- A. Create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
- B. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to enabled, and review necessary logs.
- C. Create a Cloud Armor Policy rule that denies traffic and review necessary logs.
- D. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to disabled, and review necessary logs.
Answer: A
Explanation:
https://cloud.google.com/armor/docs/security-policy-concepts#preview_mode
NEW QUESTION # 25
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
- A. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
- B. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
- C. Rename the default VPC as "Distribution" and peer it via network peering.
- D. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/using-vpc
NEW QUESTION # 26
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure an internal load balancer with the designated IPv6 address.
- B. Configure a TCP Proxy with the designated IPv6 address.
- C. Create the instance with the designated IPv6 address.
- D. Configure a global load balancer with the designated IPv6 address.
Answer: D
NEW QUESTION # 27
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?
- A. Use gcloud compute ssh to automatically copy your public ssh key to the instance.
- B. Upload your public ssh key to each instance Metadata.
- C. Create a custom Google Compute Engine image with your public ssh key embedded.
- D. Upload your public ssh key to the project Metadata.
Answer: D
NEW QUESTION # 28
Datachamps is an organization resource and it has many projects under it .The company uses BigQuery for data analysis. They want a user named admin-bigquery to be the admin for all BigQuery data across all of the projects under the Datachamps organization . Monitorbigquery is a service account that's responsible for monitoring the size of all the tables across all projects in the Datachamps organization. What predefined roles must be given to admin-bigquery (user) and Monitorbigquery (service account) .
- A. bigquery.admin to admin-bigquery and bigquery.dataViewer to Monitorbigquery service account.
- B. bigquery.user to admin-bigquery and bigquery.dataViewer to Monitorbigquery service
- C. bigquery.admin to admin-bigquery and bigquery.dataOwner to Monitorbigquery service account.
- D. bigquery.connectionAdmin to admin-bigquery and bigquery.dataEditor to Monitoringbigquery service account .
Answer: A
Explanation:
Option B is the Correct choice because, On organization Datachamps add admin-bigquery to the predefined role bigquery.admin this provides permissions to manage all resources across the project and manage all data across the project, and can cancel jobs from other users running across the project.. Add Monitorbigquery to the predefined role bigquery.dataViewer ,when applied at the project or organization level, this role can also enumerate all datasets in the project and this the appropriate role to fulfil the objective of monitoring tables across all projects .
NEW QUESTION # 29
Refer to the exhibit.
You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):
You need to update the firewall rule to add the following rule to the ruleset:
You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?
- A. Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.
- B. Assign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
- C. Assign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.
- D. Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
Answer: C
NEW QUESTION # 30
You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.
What should you do?
- A. Try connecting to the instance via SSH, and check the logs.
- B. Create a new firewall rule to allow traffic from port 22, and enable logs.
- C. Check the VPC flow logs for the instance.
- D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
Answer: D
Explanation:
Ingress packets in VPC Flow Logs are sampled after ingress firewall rules. If an ingress firewall rule denies inbound packets, those packets are not sampled by VPC Flow Logs. We want to see the logs for blocked traffic so we have to look for them in firewall logs. https://cloud.google.com/vpc/docs/flow-logs#key_properties
NEW QUESTION # 31
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-path to a specific URL used for health checking, and set responseto a string that the backend service will always return in the response body.
- B. Set proxy-header to the default value, and set hostto include a custom host header that identifies the health check.
- C. Set request-pathto a specific URL used for health checking, and set proxy-headerto PROXY_V1.
- D. Set request-path to a specific URL used for health checking, and set hostto include a custom host header that identifies the health check.
Answer: D
Explanation:
https://cloud.google.com/load-balancing/docs/health-checks
NEW QUESTION # 32
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale.
How should you provision your instances?
- A. Create an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.
- B. Create an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.
- C. Create a single managed instance group, specify the desired region, and select Multiple zones for the location.
- D. Create a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.
Answer: D
NEW QUESTION # 33
You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?
- A. Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
- B. Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.
- C. Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
- D. Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
Answer: A
NEW QUESTION # 34
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Ingress
- B. GKE Node
- C. GKE Cluster
- D. GKE Pod
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig
NEW QUESTION # 35
You recently configured Google Cloud Armor security policies to manage traffic to your application. You discover that Google Cloud Armor is incorrectly blocking some traffic to your application. You need to identity the web application firewall (WAF) rule that is incorrectly blocking traffic. What should you do?
- A. Enable firewall logs, and view the logs in Firewall Insights.
- B. Enable VPC Flow Logs, and view the logs in Cloud Logging.
- C. Enable HTTP(S) Load Balancing logging with sampling rate equal to 1, and view the logs in Cloud Logging.
- D. Enable Google Cloud Armor audit logs, and view the logs on the Activity page in the Google Cloud Console.
Answer: A
NEW QUESTION # 36
......
Guaranteed Success in Google Cloud Platform Professional-Cloud-Network-Engineer Exam Dumps: https://officialdumps.realvalidexam.com/Professional-Cloud-Network-Engineer-real-exam-dumps.html
