Best Preparations of Professional-Cloud-Network-Engineer Exam 2021 Google Cloud Platform Unlimited 80 Questions
Focus on Professional-Cloud-Network-Engineer All-in-One Exam Guide For Quick Preparation.
NEW QUESTION 15
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?
- A. Enable logging on the VM Instances that receive traffic.
- B. Create an explicit Deny Any rule and enable logging on the new rule.
- C. Create a logging sink forwarding all firewall logs with no filters.
- D. Enable logging on the default Deny Any Firewall Rule.
Answer: A
NEW QUESTION 16
You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.
What should you do?
- A. Try connecting to the instance via SSH, and check the logs.
- B. Create a new firewall rule to allow traffic from port 22, and enable logs.
- C. Check the VPC flow logs for the instance.
- D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
Answer: D
Explanation:
Ingress packets in VPC Flow Logs are sampled after ingress firewall rules. If an ingress firewall rule denies inbound packets, those packets are not sampled by VPC Flow Logs. We want to see the logs for blocked traffic so we have to look for them in firewall logs. https://cloud.google.com/vpc/docs/flow-logs#key_properties
NEW QUESTION 17
You need to centralize the Identity and Access Management permissions and email distribution for the WebServices Team as efficiently as possible.
What should you do?
- A. Create a G Suite Domain for the WebServices Team.
- B. Create a new Custom Role for all members of the WebServices Team.
- C. Create a Google Group for the WebServices Team.
- D. Create a new Cloud Identity Domain for the WebServices Team.
Answer: C
NEW QUESTION 18
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- B. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- C. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- D. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
Answer: C
NEW QUESTION 19
You are a admin at XYZ organization. Few of your team members need to use BigQuery Data Transfer Service for Amazon S3 . They want to automatically schedule and manage recurring load jobs from Amazon S3 into BigQuery, they want to run the transfer job every week. They have, Amazon S3 URI for the source data, access key ID , secret access key and Read permission on the data source . What necessary permissions are required for the transfer job creators in BigQuery .
- A. bigquery.transfer.get and bigquery.data.sets.update
- B. bigquery.jobs.create and bigquery.transfers.get
- C. bigquery.transfers.update and bigquery.transfers.get
- D. bigquery.transfers.update and bigquery.datasets.update
Answer: D
Explanation:
Option A is the correct choice because bigquery.transfers.update permissions is needed to create the transfer and bigquery.datasets.update permissions is needed on the target dataset .Also The bigquery.admin predefined Cloud IAM role includes bigquery.transfers.update and bigquery.datasets.update permissions .
Option B is Incorrect because , it is not the required permission for transfer job creators.
Option C and Option D are Incorrect because , they are not the required permission for transfer job creators.
NEW QUESTION 20
You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT.
What is the most likely cause of this problem?
- A. The instance is accessible by a load balancer external IP address.
- B. The instance has been configured with multiple interfaces.
- C. You have created static routes that use RFC1918 ranges.
- D. An external IP address has been configured on the instance.
Answer: D
Explanation:
https://www.sovereignsolutionscorp.com/google-cloud-nat/
NEW QUESTION 21
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Disable DNSSEC at your domain registar.
- B. Transfer ownership of the domain to a new registar.
- C. Update the TTL for the zone.
- D. Set the zone to the TRANSFER state.
Answer: A
Explanation:
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone.
NEW QUESTION 22
You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses.
Which two actions should you take? (Choose two.)
- A. Enable Private Google Access.
- B. Activate the Cloud Datastore API in your project.
- C. Create a private connection to a service producer.
- D. Create a custom static route to allow the traffic to reach the Cloud SQL API.
- E. Activate the Service Networking API in your project.
Answer: C,E
Explanation:
Reference:
https://cloud.google.com/sql/docs/mysql/private-ip
NEW QUESTION 23
All the instances in your project are configured with the custom metadata enable-osloginvalue set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project- wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- B. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- C. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
- D. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION 24
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
- B. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
- C. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- D. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
Answer: A
Explanation:
https://cloud.google.com/load-balancing/docs/https/setting-up-https#sendtraffic
NEW QUESTION 25
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts.
You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. Client IP, port and protocol
- B. None
- C. Client IP and protocol
- D. Client IP
Answer: D
NEW QUESTION 26
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- B. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- C. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
- D. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 27
Your developer group works on a set of VM's frequently throughout the day. To save costs, you terminate the VM when it is not in use. However, you need to preserve the contents of the disk when the VM is terminated so users can resume where they left off when a new one is created.
What is the most cost-effective way to do? (Choose two)
- A. When not in use, only stop the instance instead of deleting it.
- B. Take a snapshot of the disk before terminating the VM.
- C. Back up the disk contents to Cloud Storage before deleting.
- D. Set the disk to no-auto-delete to preserve contents.
Answer: A,D
Explanation:
A (Correct Answer) - Set the disk to no-auto-delete to preserve contents. Setting your instance to not delete the root disk when deleting the instance will preserve the disk contents to attach to a new instance.
C (Correct Answer) - When not in use, only stop the instance instead of deleting it. Alternatively, you can merely stop the instance instead of deleting it, during which time you will not be billed for Machine Type usage (just disk storage).
B and D may work but are not suitable solutions since the VMs may need frequently stop and resume throughout the day.
More Information:
https://cloud.google.com/sdk/gcloud/reference/compute/instances/set-disk-auto-delete
NEW QUESTION 28
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?
- A. Use gcloud compute ssh to automatically copy your public ssh key to the instance.
- B. Create a custom Google Compute Engine image with your public ssh key embedded.
- C. Upload your public ssh key to each instance Metadata.
- D. Upload your public ssh key to the project Metadata.
Answer: D
NEW QUESTION 29
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* BGP sessions are established between both on-premises routers and the Cloud Router.
* Only 1 of the on-premises router's routes are being added to the routing table.
What is the most likely cause of this problem?
- A. The ASNs being used on the on-premises routers are different.
- B. You do not have a load balancer to load-balance the network traffic.
- C. The on-premises routers are configured with the same routes.
- D. A firewall is blocking the traffic across the second VPN connection.
Answer: B
NEW QUESTION 30
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices.
How should you design this topology?
- A. Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- B. Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
- C. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
- D. Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
Answer: C
NEW QUESTION 31
......
Guaranteed Success with Professional-Cloud-Network-Engineer Dumps: https://www.ipassleader.com/Google/Professional-Cloud-Network-Engineer-practice-exam-dumps.html
Pass Google Professional-Cloud-Network-Engineer Exam – Experts Are Here To Help You: https://drive.google.com/open?id=1cXdBRdL6qeK01I0r3WT5cVJnJorWDTqK