2023 Latest 100% Exam Passing Ratio - Professional-Cloud-Network-Engineer Dumps PDF
Pass Exam With Full Sureness - Professional-Cloud-Network-Engineer Dumps with 155 Questions
NEW QUESTION 28
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
- A. Dedicated Interconnect
- B. Shared VPC
- C. Cloud VPN
- D. VPC peering
- E. Cloud NAT
Answer: A,C
NEW QUESTION 29
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. Network load balancer
- B. HTTPS load balancer
- C. TCP proxy load balancer
- D. SSL proxy load balancer
Answer: D
NEW QUESTION 30
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP- capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. * Create a Cloud VPN instance.
* Create a policy-based VPN tunnel per subnet.
* Configure the appropriate local and remote traffic selectors to match your local and remote networks.
* Create the appropriate static routes. - B. * Create a Cloud VPN instance.
* Create a route-based VPN tunnel.
* Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.
* Configure the appropriate static routes. - C. * Create a Cloud VPN instance.
* Create a policy-based VPN tunnel.
* Configure the appropriate local and remote traffic selectors to match your local and remote networks.
* Configure the appropriate static routes. - D. * Create a Cloud VPN instance.
* Create a route-based VPN tunnel.
* Configure the appropriate local and remote traffic selectors to match your local and remote networks.
* Configure the appropriate static routes.
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/vpn/docs/concepts/choosing-networks-routing
NEW QUESTION 31
You need to enable Cloud CDN for all the objects inside a storage bucket. You want to ensure that all the object in the storage bucket can be served by the CDN.
What should you do in the GCP Console?
- A. Create a new cloud storage bucket, and then enable Cloud CDN on it.
- B. Create a new HTTP load balancer, select the storage bucket as a backend, enable Cloud CDN on the backend, and make sure each object inside the storage bucket is shared publicly.
- C. Create a new TCP load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
- D. Create a new SSL proxy load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
Answer: B
Explanation:
https://cloud.google.com/load-balancing/docs/https/adding-backend-buckets-to-load-balancers#using_cloud_cdn_with_cloud_storage_buckets Cloud CDN needs HTTP(S) Load Balancers and Cloud Storage bucket has to be shared publicly. https://cloud.google.com/cdn/docs/setting-up-cdn-with-bucket
NEW QUESTION 32
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service.
What should you do?
- A. Create a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.
- B. Create a VPC Service Control Perimeter that blocks all traffic except for the traffic-scrubbing service.
- C. Create IPTables firewall rules that block all traffic except for the traffic-scrubbing service.
- D. Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.
Answer: D
Explanation:
Global load balancer will proxy the connection . thus no trace of session origin IP. you should use Cloud Armor to geofence your service.
https://cloud.google.com/load-balancing/docs/https
NEW QUESTION 33
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A. Assign members of the networking team the compute.networkUser role.
- B. Assign members of the networking team the compute.networkAdmin role.
- C. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
- D. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.
Answer: B
NEW QUESTION 34
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?
- A. Upload your public ssh key to the project Metadata.
- B. Use gcloud compute ssh to automatically copy your public ssh key to the instance.
- C. Create a custom Google Compute Engine image with your public ssh key embedded.
- D. Upload your public ssh key to each instance Metadata.
Answer: A
Explanation:
https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
NEW QUESTION 35
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?
- A. Configure VPC peering in a full mesh.
- B. Create network tags to allow connectivity between all three VPCs.
- C. Alter the routing table to resolve the asymmetric route.
- D. Delete the legacy network and recreate it to allow transitive peering.
Answer: A
Explanation:
https://cloud.google.com/vpc/docs/using-vpc-peering
NEW QUESTION 36
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?
- A. Enable logging on the VM Instances that receive traffic.
- B. Create an explicit Deny Any rule and enable logging on the new rule.
- C. Create a logging sink forwarding all firewall logs with no filters.
- D. Enable logging on the default Deny Any Firewall Rule.
Answer: A
NEW QUESTION 37
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Add a second on-premises VPN gateway with a different public IP address.
Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP. - B. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- C. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- D. Add a second Cloud VPN gateway in a different region than the existing VPN gateway.
Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
Answer: B
Explanation:
https://cloud.google.com/vpn/docs/concepts/classic-topologies
NEW QUESTION 38
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the compute.instanceAdmin to your user account.
- B. Grant the read-only privilege to the service account for the Cloud Storage bucket.
- C. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
- D. Grant the iam.serviceAccountUser to your user account.
Answer: D
Explanation:
https://cloud.google.com/compute/docs/access/iam
NEW QUESTION 39
Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers.
The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.
How should you deploy this service in GCP?
- A. Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
- B. Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.
- C. Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal- priority static routes to the backend servers.
- D. Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.
Answer: D
Explanation:
https://cloud.google.com/compute/docs/instance-groups/adding-an-instance-group-to-a-load-balancer
NEW QUESTION 40
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
- B. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- C. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
- D. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION 41
You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours.
Which connectivity method should you choose?
- A. Dedicated Interconnect with a single VLAN attachment
- B. 50-Mbps Partner VLAN attachment
- C. Cloud VPN
- D. Dedicated Interconnect, but don't provision any VLAN attachments
Answer: C
NEW QUESTION 42
You are developing an HTTP API hosted on a Compute Engine virtual machine instance that must be invoked only by multiple clients within the same Virtual Private Cloud (VPC). You want clients to be able to get the IP address of the service. What should you do?
- A. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Clients should use this IP address to connect to the service.
- B. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Then, define an A record in Cloud DNS. Clients should use the name of the A record to connect to the service.
- C. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url https://[API_NAME]/[API_VERSION]/.
- D. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url https://[INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal/.
Answer: B
NEW QUESTION 43
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection.
Which two actions can accomplish this? (Choose two.)
- A. Run gcloud compute interconnects describe <interconnect>.
- B. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.
- C. Check the email for the account of the NOC contact that you specified during the ordering process.
- D. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
- E. Open a Cloud Support ticket under the Cloud Interconnect category.
Answer: C,D
NEW QUESTION 44
Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.
How should you deploy this service in GCP?
- A. Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal-priority static routes to the backend servers.
- B. Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
- C. Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.
- D. Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.
Answer: D
NEW QUESTION 45
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Pod
- B. GKE Ingress
- C. GKE Node
- D. GKE Cluster
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig
NEW QUESTION 46
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. Create a Cloud VPN instance.
Create a route-based VPN tunnel.
Configure the appropriate local and remote traffic selectors to match your local and remote networks.
Configure the appropriate static routes. - B. Create a Cloud VPN instance.
Create a policy-based VPN tunnel per subnet.
Configure the appropriate local and remote traffic selectors to match your local and remote networks.
Create the appropriate static routes. - C. Create a Cloud VPN instance.
Create a policy-based VPN tunnel.
Configure the appropriate local and remote traffic selectors to match your local and remote networks.
Configure the appropriate static routes. - D. Create a Cloud VPN instance.
Create a route-based VPN tunnel.
Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.
Configure the appropriate static routes.
Answer: D
Explanation:
https://cloud.google.com/vpn/docs/concepts/choosing-networks-routing
NEW QUESTION 47
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
- B. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- C. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- D. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/vpc-peering
NEW QUESTION 48
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
- A. Shared VPC
- B. Dedicated Interconnect
- C. VPC peering
- D. Cloud VPN
- E. Cloud NAT
Answer: C,D
Explanation:
Google Cloud VPC Network Peering allows internal IP address connectivity across two Virtual Private Cloud (VPC) networks regardless of whether they belong to the same project or the same organization.
NEW QUESTION 49
......
The benefit of obtaining the Google Professional Cloud Network Engineer Exam Certification
- Google Professional Cloud Network Engineer Exam provide proven knowledge to use the tools to complete the task efficiently and cost effectively than the other non-certified professionals lack in doing so.
- Google Professional Cloud Network Engineer Certification provides practical experience to candidates from all the aspects to be a proficient worker in the organization.
- Google Professional Cloud Network Engineer Certifications provide opportunities to get a job easily in which they are interested in instead of wasting years and ending without getting any experience.
- Google Professional Cloud Network Engineer Certification is distinguished among competitors. Google Professional Cloud Network Engineer certification can give them an edge at that time easily when candidates appear for employment interview, employers are very fascinated to note one thing that differentiates the individual from all other candidates.
- Google Professional Cloud Network Engineer will be confident and stand different from others as their skills are more trained than non-certified professionals.
Verified Professional-Cloud-Network-Engineer dumps Q&As - 100% Pass from PracticeDump: https://testking.practicedump.com/Professional-Cloud-Network-Engineer-exam-questions.html