[UPDATED 2022] Google Professional-Cloud-Network-Engineer Questions Prepare with Free Demo of PDF [Q28-Q49]

[UPDATED 2022] Google Professional-Cloud-Network-Engineer Questions Prepare with Free Demo of PDF

NEW 2022 Certification Sample Questions Professional-Cloud-Network-Engineer Dumps & Practice Exam

How to book Google Professional Cloud Network Engineer Exams

The registration for the Google Professional Cloud Network Engineer Exam follows the steps given below.

• Step 1: Visit the Google Cloud Webassessor Website
• Step 2: Sign in or sign up to your Google Cloud Webassessor account
• Step 3: Search for the exam name Google Professional Cloud Network Engineer
• Step 4: Take the date of the exam, choose exam center and make further payment using payment method like credit/debit etc.

Who should take the Google Professional Cloud Network Engineer exam

Individuals should pursue the Google Professional Cloud Network Engineer Exam if they want to demonstrate their expertise and ability to design, plan, and prototype a GCP Network , implement a GCP Virtual Private Cloud (VPC), implement network security. It’s perfect for network engineers, systems administrators or operations team members or simply any professional who wants in on this specific area of IT and cloud.

 

NEW QUESTION 28
You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT.
What is the most likely cause of this problem?

• A. The instance has been configured with multiple interfaces.
• B. An external IP address has been configured on the instance.
• C. You have created static routes that use RFC1918 ranges.
• D. The instance is accessible by a load balancer external IP address.

Answer: B

Explanation:
Explanation/Reference: https://www.sovereignsolutionscorp.com/google-cloud-nat/

 

NEW QUESTION 29
You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.
What should you do?

• A. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
• B. Check the VPC flow logs for the instance.
• C. Try connecting to the instance via SSH, and check the logs.
• D. Create a new firewall rule to allow traffic from port 22, and enable logs.

Answer: B

 

NEW QUESTION 30
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?

• A. Enable logging on the VM Instances that receive traffic.
• B. Create a logging sink forwarding all firewall logs with no filters.
• C. Create an explicit Deny Any rule and enable logging on the new rule.
• D. Enable logging on the default Deny Any Firewall Rule.

Answer: A

 

NEW QUESTION 31
You work for a multinational enterprise that is moving to GCP.
These are the cloud requirements:
* An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup)
* Multiple regional offices in Europe and APAC
* Regional data processing is required in europe-west1 and australia-southeast1
* Centralized Network Administration Team
Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us-west1.
What should you do?

• A. * Create 2 VPCs in a Shared VPC Host Project.* Configure a 2-NIC instance in zone us-west1-a in the Service Project.* Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.* Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.
• B. * Create 1 VPC in a Shared VPC Service Project.* Configure a 2-NIC instance in zone us-west1-a in the Service Project.* Attach NIC0 in us-west1 subnet of the Service Project.* Attach NIC1 in us-west1 subnet of the Service Project* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.
• C. * Create 1 VPC in a Shared VPC Host Project.* Configure a 2-NIC instance in zone us-west1-a in the Host Project.* Attach NIC0 in us-west1 subnet of the Host Project.* Attach NIC1 in us-west1 subnet of the Host Project* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.
• D. * Create 2 VPCs in a Shared VPC Host Project.* Configure a 2-NIC instance in zone us-west1-a in the Host Project.* Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.* Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.* Deploy the instance.* Configure the necessary routes and firewall rules to pass traffic through the instance.

Answer: A

Explanation:
https://cloud.google.com/vpc/docs/shared-vpc

 

NEW QUESTION 32
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?

• A. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A.
• B. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.
• C. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag.
• D. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.

Answer: D

 

NEW QUESTION 33
You are creating an instance group and need to create a new health check for HTTP(s) load balancing.
Which two methods can you use to accomplish this? (Choose two.)

• A. Create a new legacy health check using the gcloud command line tool.
• B. Create a new legacy health check using the Health checks section in the GCP Console.
• C. Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the GCP Console.
• D. Create a new health check using the VPC Network section in the GCP Console.
• E. Create a new health check using the gcloud command line tool.

Answer: B,E

Explanation:
Reference:
https://cloud.google.com/load-balancing/docs/health-checks

 

NEW QUESTION 34
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:
IP ranges for pods and services must be as small as possible.
The nodes and the master must not be reachable from the internet.
You must be able to use kubectl commands from on-premises subnets to manage the cluster.
How should you create the GKE cluster?

• A. * Create a VPC-native GKE cluster using user-managed IP ranges.
  * Enable privateEndpoint on the cluster master.
  * Set the pod and service ranges as /24.
  * Set up a network proxy to access the master.
  * Enable master authorized networks.
• B. * Create a private cluster that uses VPC advanced routes.
  * Set the pod and service ranges as /24.
  * Set up a network proxy to access the master.
• C. * Create a VPC-native GKE cluster using GKE-managed IP ranges.
  * Set the pod IP range as /21 and service IP range as /24.
  * Set up a network proxy to access the master.
• D. * Create a VPC-native GKE cluster using user-managed IP ranges.
  * Enable a GKE cluster network policy, set the pod and service ranges as /24.
  * Set up a network proxy to access the master.
  * Enable master authorized networks.

Answer: A

Explanation:
Creating GKE private clusters with network proxies for controller access When you create a GKE private cluster with a private cluster controller endpoint, the cluster's controller node is inaccessible from the public internet, but it needs to be accessible for administration. By default, clusters can access the controller through its private endpoint, and authorized networks can be defined within the VPC network. To access the controller from on-premises or another VPC network, however, requires additional steps. This is because the VPC network that hosts the controller is owned by Google and cannot be accessed from resources connected through another VPC network peering connection, Cloud VPN or Cloud Interconnect. https://cloud.google.com/solutions/creating-kubernetes-engine-private-clusters-with-net-proxies

 

NEW QUESTION 35
You work for a university that is migrating to GCP.
These are the cloud requirements:
* On-premises connectivity with 10 Gbps
* Lowest latency access to the cloud
* Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?

• A. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
• B. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
• C. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
• D. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.

Answer: B

Explanation:
https://cloud.google.com/interconnect/docs/how-to/dedicated/using-interconnects-other-projects Using Cloud Interconnect with Shared VPC You can use Shared VPC to share your VLAN attachment in a project with other VPC networks. Choosing Shared VPC is preferable if you need to create many projects and would like to prevent individual project owners from managing their connectivity back to your on-premises network. In this scenario, the host project contains a common Shared VPC network usable by VMs in service projects. Because VMs in the service projects use this network, Service Project Admins don't need to create other VLAN attachments or Cloud Routers in the service projects. In this scenario, you must create VLAN attachments and Cloud Routers for a Cloud Interconnect connection only in the Shared VPC host project. The combination of a VLAN attachment and its associated Cloud Router are unique to a given Shared VPC network. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/enabling-multiple-networks-access-same-attachment#using_with
https://cloud.google.com/vpc/docs/shared-vpc

 

NEW QUESTION 36
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?

• A. Create a custom Google Compute Engine image with your public ssh key embedded.
• B. Upload your public ssh key to each instance Metadata.
• C. Upload your public ssh key to the project Metadata.
• D. Use gcloud compute ssh to automatically copy your public ssh key to the instance.

Answer: C

 

NEW QUESTION 37
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?

• A. Set request-pathto a specific URL used for health checking, and set proxy-headerto PROXY_V1.
• B. Set request-path to a specific URL used for health checking, and set responseto a string that the backend service will always return in the response body.
• C. Set proxy-header to the default value, and set hostto include a custom host header that identifies the health check.
• D. Set request-path to a specific URL used for health checking, and set hostto include a custom host header that identifies the health check.

Answer: D

Explanation:
https://cloud.google.com/load-balancing/docs/health-checks

 

NEW QUESTION 38
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?

• A. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
• B. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
• C. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
• D. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.

Answer: C

 

NEW QUESTION 39
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?

• A. Create a custom Google Compute Engine image with your public ssh key embedded.
• B. Use gcloud compute sshto automatically copy your public ssh key to the instance.
• C. Upload your public ssh key to each instance Metadata.
• D. Upload your public ssh key to the project Metadata.

Answer: D

Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

 

NEW QUESTION 40
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?

• A. A firewall is blocking the traffic across the second VPN connection.
• B. One of the VPN sessions is configured incorrectly.
• C. BGP sessions are not established between both on-premises routers and the Cloud Router.
• D. You do not have a load balancer to load-balance the network traffic.

Answer: B

Explanation:
If the VPN logs show a no-proposal-chosen error, this error indicates that Cloud VPN and your peer VPN gateway were unable to agree on a set of ciphers. For IKEv1, the set of ciphers must match exactly. For IKEv2, there must be at least one common cipher proposed by each gateway. Make sure that you use supported ciphers to configure your peer VPN gateway. https://cloud.google.com/network-connectivity/docs/vpn/support/troubleshooting#:~:text=If%20the%20VPN%20logs%20show,of%20ciphers%20must%20match%20exactly.&text=Make%20sure%20that%20you%20use,configure%20your%20peer%20VPN%20gateway.

 

NEW QUESTION 41
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?

• A. Compress files using utilities like tar to reduce the size of data being sent.
• B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
• C. Tune TCP parameters on the on-premises servers.
• D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].

Answer: D

 

NEW QUESTION 42
You want to create a service in GCP using IPv6.
What should you do?

• A. Configure a TCP Proxy with the designated IPv6 address.
• B. Create the instance with the designated IPv6 address.
• C. Configure an internal load balancer with the designated IPv6 address.
• D. Configure a global load balancer with the designated IPv6 address.

Answer: D

Explanation:
https://cloud.google.com/load-balancing/docs/ipv6

 

NEW QUESTION 43
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?

• A. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
• B. Rename the default VPC as "Distribution" and peer it via network peering.
• C. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
• D. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.

Answer: A

 

NEW QUESTION 44
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale.
How should you provision your instances?

• A. Create a single managed instance group, specify the desired region, and select Multiple zones for the location.
• B. Create an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.
• C. Create a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.
• D. Create an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.

Answer: A

Explanation:
https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances

 

NEW QUESTION 45
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?

• A. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
• B. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
• C. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
• D. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.

Answer: C

Explanation:
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration. This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network.

 

NEW QUESTION 46
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
Which BGP attribute should you use on your on-premises router?

• A. Multi-exit Discriminator
• B. Community
• C. AS-Path
• D. Local Preference

Answer: A

 

NEW QUESTION 47
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google- recommended practices.
How should you design this topology?

• A. Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them.
  Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
• B. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
• C. Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them.
  Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
• D. Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them.
  Use firewall rules to filter access between the specific networks.

Answer: B

Explanation:
https://cloud.google.com/vpc/docs/shared-vpc

 

NEW QUESTION 48
An application development team believes their current logging tool will not meet their needs for their new cloud-based product. They want a better tool to capture errors and help them analyze their historical log data. You want to help them find a solution that meets their needs, what should you do?

• A. Help them define their requirements and assess viable logging tools.
• B. Send them a list of online resources about logging best practices.
• C. Help them upgrade their current tool to take advantage of any new features.
• D. Direct them to download and install the Google StackDriver logging agent.

Answer: A

Explanation:
A and D can be ruled out for them are not general IT good practices. They need your help, not just simply to sell your products, or point them to the crowded resource without explains.
B (Correct Answer) - Help them define their requirements and assess viable logging tools. They know the requirements and the existing tools' problems. While it's true StackDriver Logging and Error Reporting meet all their requirements, they need you to provide expertise to make assessment for new tools, specifically, logging tools that can capture errors and help them analyze their historical log data?
C - Help them upgrade their current tool to take advantage of any new features. They have already used and know those tools' shortcomings. They need your help to find better one. Simply help them upgrade for new features is not enough and may not resolve the problems

 

NEW QUESTION 49
......

Target Audience and Requirements

The target candidates for this certification are Cloud network engineers. These specialists manage and implement network architectures within Google Cloud Platform. They have practice experience on Google Cloud Platform and also possess the skills required for networking architects and teams that design infrastructures or work with Cloud. These individuals have what it takes to leverage their experiences in implementing CPCs, network services, security, and hybrid connectivity for different established network architectures.

Please note that this certification has no official prerequisites. However, it is recommended that the test takers have at least three years of industry experience as well as one year of expertise in designing and managing solutions with the use of Google Cloud Platform.

 

Professional-Cloud-Network-Engineer Deluxe Study Guide with Online Test Engine: https://www.dumpsmaterials.com/Professional-Cloud-Network-Engineer-real-torrent.html

Professional-Cloud-Network-Engineer Test Prep Training Practice Exam Questions Practice Tests: https://drive.google.com/open?id=1vOy9SlXqEoqHR1ua2DYkFwxciKp-rsO-