[Feb-2023] 100% Actual Professional-Cloud-Network-Engineer dumps Q&As with Explanations Verified & Correct Answers
Professional-Cloud-Network-Engineer Dumps with Free 365 Days Update Fast Exam Updates
NEW QUESTION 78
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services.
Create a VPC-native cluster and specify those ranges. - B. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services.
Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets. - C. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
- D. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.
Answer: B
Explanation:
https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters
NEW QUESTION 79
You are configuring load balancing for a standard three-tier (web, application, and database) application. You have configured an external HTTP(S) load balancer for the web servers. You need to configure load balancing for the application tier of servers. What should you do?
- A. Configure a URL map on the existing load balancer to route traffic to the application tier.
- B. Configure a forwarding rule on the existing load balancer for the application tier.
- C. Configure equal cost multi-path routing on the application servers.
- D. Configure a new internal HTTP(S) load balancer for the application tier.
Answer: B
NEW QUESTION 80
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
- B. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
- C. Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.
- D. Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
Answer: B
Explanation:
https://cloud.google.com/load-balancing/docs/health-check-concepts#content-based_health_checks
NEW QUESTION 81
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command.
Which next hop should you choose?
- A. The default internet gateway
- B. The IP address of the instance on the remote side of the VPN tunnel
- C. The name and region of the Cloud VPN tunnel
- D. The IP address of the Cloud VPN gateway
Answer: C
Explanation:
When you create a route based tunnel using the Cloud Console, Classic VPN performs both of the following tasks: Sets the tunnel's local and remote traffic selectors to any IP address (0.0.0.0/0) For each range in Remote network IP ranges, Google Cloud creates a custom static route whose destination (prefix) is the range's CIDR, and whose next hop is the tunnel. https://cloud.google.com/network-connectivity/docs/vpn/how-to/creating-static-vpns
NEW QUESTION 82
You want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN. You need to restrict reachability over the tunnel to specific local subnets, and you do not have a device capable of speaking Border Gateway Protocol (BGP).
Which routing option should you choose?
- A. Dynamic routing using Cloud Router
- B. Policy-based routing using the default local traffic selector
- C. Policy-based routing using a custom local traffic selector
- D. Route-based routing using default traffic selectors
Answer: A
Explanation:
Reference:
https://cloud.google.com/vpn/docs/concepts/overview
NEW QUESTION 83
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are
100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Compress files using utilities like tar to reduce the size of data being sent.
- B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- C. Tune TCP parameters on the on-premises servers.
- D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
Answer: D
Explanation:
https://cloud.google.com/solutions/transferring-big-data-sets-to-gcp
NEW QUESTION 84
You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses.
Which two actions should you take? (Choose two.)
- A. Create a custom static route to allow the traffic to reach the Cloud SQL API.
- B. Enable Private Google Access.
- C. Create a private connection to a service producer.
- D. Activate the Cloud Datastore API in your project.
- E. Activate the Service Networking API in your project.
Answer: C,E
Explanation:
Explanation/Reference: https://cloud.google.com/sql/docs/mysql/private-ip
NEW QUESTION 85
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the private attribute.
- B. Ensure that the object you don't want to be cached anymore is not shared publicly.
- C. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
- D. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
Answer: D
Explanation:
https://cloud.google.com/cdn/docs/invalidating-cached-content
NEW QUESTION 86
In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost:
Port 8080 should always be open for VMs in the projects in the Dev folder.
Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder.
What should you do?
- A. In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
- B. Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
- C. Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects. Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared VPCs.
- D. Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.
Answer: B
NEW QUESTION 87
You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)
- A. Turn on Private Google Access at the subnet level.
- B. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
- C. Turn on Private Google Access at the VPC level.
- D. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
- E. Turn on Private Services Access at the VPC level.
Answer: B,E
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/private-access-options
NEW QUESTION 88
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Transfer ownership of the domain to a new registar.
- B. Set the zone to the TRANSFER state.
- C. Update the TTL for the zone.
- D. Disable DNSSEC at your domain registar.
Answer: D
Explanation:
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone.
https://cloud.google.com/dns/docs/dnssec-config
NEW QUESTION 89
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
GetIamPolicy() via REST API
- A. setIamPolicy() via REST API
- B. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --
- C. role roles/editor
gcloud projects add-iam-policy-binding Sprojectname --member user:Susername -- - D. role roles/editor
- E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
Answer: D,E
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/granting-changing-revoking-access
NEW QUESTION 90
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service.
What should you do?
- A. Create a VPC Service Control Perimeter that blocks all traffic except for the traffic-scrubbing service.
- B. Create a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.
- C. Create IPTables firewall rules that block all traffic except for the traffic-scrubbing service.
- D. Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.
Answer: D
Explanation:
Global load balancer will proxy the connection . thus no trace of session origin IP. you should use Cloud Armor to geofence your service.
https://cloud.google.com/load-balancing/docs/https
NEW QUESTION 91
You work for a university that is migrating to GCP.
These are the cloud requirements:
- On-premises connectivity with 10 Gbps
- Lowest latency access to the cloud
- Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects.
You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- B. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
- C. Use Shared VPC, and deploy the VLAN attachments in the service projects.
Connect the VLAN attachment to the Shared VPC's host project. - D. Use standalone projects, and deploy the VLAN attachments in the individual projects.
Connect the VLAN attachment to the standalone projects' Interconnects.
Answer: C
NEW QUESTION 92
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)
- A. Create a Cloud NAT, and route the application traffic via NAT gateway.
- B. Create network peering between your VPC and BigQuery.
- C. Enable Private Services Access on the VPC.
- D. Enable Private Google Access on all the subnets.
- E. Enable Private Google Access on the VPC.
Answer: A,D
Explanation:
https://cloud.google.com/nat/docs/overview#interaction-pga Specifications https://cloud.google.com/vpc/docs/configure-private-google-access#specifications
NEW QUESTION 93
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Compress files using utilities like tar to reduce the size of data being sent.
- B. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET_NAME].
- C. Tune TCP parameters on the on-premises servers.
- D. Remove the -m flag from the gsutil command to enable single-threaded transfers.
Answer: C
NEW QUESTION 94
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts.
You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. None
- B. Client IP and protocol
- C. Client IP
- D. Client IP, port and protocol
Answer: C
NEW QUESTION 95
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
- B. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel per subnet.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Create the appropriate static routes.
- C. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.* Configure the appropriate static routes.
- D. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
Answer: D
Explanation:
https://cloud.google.com/network-connectivity/docs/vpn/how-to/creating-static-vpns#creating_a_gateway_and_tunnel
NEW QUESTION 96
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- B. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
- C. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- D. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
Answer: C
Explanation:
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration. This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network.
Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
NEW QUESTION 97
Your company has launched a mobile application that uploads pictures to google cloud storage bucket. The application was successfully uploading the pictures to google cloud storage buckets, but lately the application has become popular and you start seeing 429 errors. Please suggest the ways to address the issue. Please select any two.
- A. Use the correct verb with the /upload or /download URLs.
- B. The OAuth access token has expired and needs to be refreshed.
- C. Use truncated exponential backoff
- D. Throttle your client's requests
Answer: C
Explanation:
Option A and Option B are the Correct choices because , a 429 error is caused by Too Many Requests.If your application tries to use more than its limit, additional requests will fail. Throttle your client's requests, and/or use truncated exponential backoff.
Option C is Incorrect choice because, a OAuth access token has expiry would result in error
401(Unauthorized)
Option D is Incorrect because, using wrong verb with /upload or /download URLs would lead to
405 (method not allowed error).
NEW QUESTION 98
......
Verified Professional-Cloud-Network-Engineer dumps Q&As - 2023 Latest Professional-Cloud-Network-Engineer Download: https://www.pass4surequiz.com/Professional-Cloud-Network-Engineer-exam-quiz.html
Dumps Questions [2023] Pass for Professional-Cloud-Network-Engineer Exam: https://drive.google.com/open?id=1mOUrkutw92qvbA9OniSXEXkpCMXQt1Ds