Google Professional-Cloud-Network-Engineer Cert Guide PDF 100% Cover Real Exam Questions
Pass Professional-Cloud-Network-Engineer Exam - Real Questions and Answers
Exam Details and Topics
As for the qualifying exam, you need to know that it can only be taken in the English language, and the candidates have two hours for its completion. The question formats of the test include multiple choice and multiple select. The cost for taking the Professional Cloud Network Engineer certification exam is $200. You can choose to sit for it as an online proctored or an on-site proctored option.
Topics of Google Professional Cloud Network Engineer Exam
Candidates must know the exam topics before they start of preparation. because it will really help them in hitting the core. Our Google Professional Cloud Network Engineer Dumps will include the following topics:
Network architectures, this individual ensures successful cloud implementations using the command line interface or the Google Cloud Platform Console.
1. Designing, planning, and prototyping a GCP network
Designing the overall network architecture
- Options for high availability
- SaaS, PaaS, and IaaS services
- Hybrid connectivity (e.g., Google private access for hybrid connectivity)
- IAM and security
- Optimizing for latency (e.g., MTU size, caches, CDN)
- Container networking
- DNS strategy (e.g., on-premises, Cloud DNS, GSLB)
- Choosing the appropriate load balancing options
- Failover and disaster recovery strategy
Designing a Virtual Private Cloud (VPC). Considerations include:
- Standalone or shared
- Peering
- Firewall (e.g., service account-based, tag-based)
- IP addressing (e.g., static, ephemeral, private)
Designing a hybrid network. Considerations include:
- Shared vs. standalone VPC interconnect access
- Bandwidth
- Failover and disaster recovery strategy (e.g., building high availability with BGP using cloud router)
- Cross-organizational access
- IPsec VPN
- Using interconnect (e.g., dedicated vs. partner)
Designing a container IP addressing plan for Google Kubernetes Engine
2. Implementing a GCP Virtual Private Cloud (VPC)
Configuring VPCs. Considerations include:
- Configuring GCP VPC resources (CIDR range, subnets, firewall rules, etc.)
- Configuring VPC flow logs
- Creating a shared VPC and explaining how to share subnets with other projects
- Configuring VPC peering
- Configuring API access (private, public, NAT GW, proxy)
Configuring routing. Tasks include:
- Configuring NAT (e.g., Cloud NAT, instance-based NAT)
- Configuring internal static/dynamic routing
- Configuring routing policies using tags and priority
Configuring and maintaining Google Kubernetes Engine clusters. Considerations include:
- VPC-native clusters using alias IPs
- Adding authorized networks for cluster master access
- Private clusters
- Cluster network policy
- Clusters with shared VPC
Configuring and managing firewall rules. Considerations include:
- Ingress and egress rules
- Priority
- Network protocols
- Firewall logs
- Target network tags and service accounts
3. Configuring network services
Configuring load balancing. Considerations include:
- Creating backend services
- Network load balancer
- TCP and SSL proxy load balancers
- Session affinity
- Internal load balancer
- Firewall and security rules
Configuring Cloud CDN. Considerations include:
- Signed URLs
- Using cache keys
- Enabling and disabling Cloud CDN
- Cache invalidation
Configuring and maintaining Cloud DNS. Considerations include:
- Integrating on-premises DNS with GCP
- DNS Security (DNSSEC)
- Internal DNS
- Migrating to Cloud DNS
Enabling other network services. Considerations include:
- Canary (A/B) releases
- Enabling private API access
- Distributing backend instances using regional managed instance groups
- Health checks for your instance groups
4. Implementing hybrid interconnectivity
Configuring interconnect. Considerations include:
- Bulk storage uploads
- Partner (e.g., layer 2 vs. layer 3 connectivity)
- Virtualizing using VLAN attachments
Configuring a site-to-site IPsec VPN (e.g., route-based, policy-based, dynamic or static routing).
Configuring Cloud Router for reliability.
5. Implementing network security
Configuring identity and access management (IAM). Tasks include:
- Using pre-defined IAM roles (e.g., network admin, network viewer, network user)
- Defining custom IAM roles
- Assigning IAM roles to accounts or Google Groups
- Viewing account IAM assignments
Configuring Cloud Armor policies. Considerations include:
- IP-based access control
Configuring third-party device insertion into VPC using multi-nic (NGFW)
Managing keys for SSH access
6. Managing and monitoring network operations
Logging and monitoring with Stackdriver or GCP Console
Managing and maintaining security. Considerations include:
- Diagnosing and resolving IAM issues (shared VPC, security/network admin)
- Firewalls (e.g., cloud-based, private)
Maintaining and troubleshooting connectivity issues. Considerations include:
- Monitoring firewall logs
- Troubleshooting Cloud Router BGP peering issues
- Managing and troubleshooting VPNs
- Identifying traffic flow topology (e.g., load balancers, SSL offload, network endpoint groups)
- Draining and redirecting traffic flows
Monitoring, maintaining, and troubleshooting latency and traffic flow. Considerations include:
Network throughput and latency testing Routing issues Tracing traffic flow
7. Optimizing network resources
Optimizing traffic flow. Considerations include:
- Load balancer and CDN location
- Expanding subnet CIDR ranges in service
- Accommodating workload increases (e.g., autoscaling vs. manual scaling)
- Global vs. regional dynamic routing
Optimizing for cost and efficiency. Considerations include:
- Automation
- Cost optimization (Network Service Tiers, Cloud CDN, autoscaler [max instances])
- Bandwidth utilization (e.g., kernel sys tuning parameters)
- VPN vs. interconnect
NEW QUESTION 25
You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application.
Which type of load balancer should you use?
- A. HTTP(S) load balancer
- B. Network load balancer
- C. Internal TCP/UDP load balancer
- D. TCP/SSL proxy load balancer
Answer: C
NEW QUESTION 26
You have enabled HTTP(S) load balancing for your application, and your application developers have reported that HTTP(S) requests are not being distributed correctly to your Compute Engine Virtual Machine instances. You want to find data about how the request are being distributed.
Which two methods can accomplish this? (Choose two.)
- A. On the Load Balancer details page of the GCP Console, click on the Monitoring tab, select your backend service, and look at the graphs.
- B. In Stackdriver Monitoring, select Resources > Google Cloud Load Balancers and review the Key Metrics graphs in the dashboard.
- C. In Stackdriver Monitoring, select Resources > Metrics Explorer and search for https/request_bytes_count metric.
- D. In Stackdriver Monitoring, create a new dashboard and track the https/backend_request_count metric for the load balancer.
- E. In Stackdriver Error Reporting, look for any unacknowledged errors for the Cloud Load Balancers service.
Answer: A,D
NEW QUESTION 27
You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)
- A. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
- B. Turn on Private Services Access at the VPC level.
- C. Turn on Private Google Access at the subnet level.
- D. Turn on Private Google Access at the VPC level.
- E. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
Answer: A,B
NEW QUESTION 28
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?
- A. Create 2 VPCs, each with their own region and individual subnets.
Use external IP addresses on the instances to establish connectivity between these regions. - B. Create 2 VPCs, each with their own regions and individual subnets.
Create 2 VPN gateways to establish connectivity between these regions. - C. Create 1 VPC with 2 regional subnets.
Create a global load balancer to establish connectivity between the regions. - D. Create 1 VPC with 2 regional subnets.
Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
Answer: D
Explanation:
VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.
https://cloud.google.com/vpc/docs/vpc-peering
NEW QUESTION 29
The security team has disabled external SSH access into production virtual machines in GCP.
The operations team needs to remotely manage the VMs and other resources. What can they do?
- A. Grant the operations team access to use Google Cloud Shell.
- B. Develop a new access request process that grants temporary SSH access to cloud VMs when an operations engineer needs to perform a task.
- C. Configure a VPN connection to GCP to allow SSH access to the cloud VMs.
- D. Have the development team build an API service that allows the operations team to execute specific remote procedure calls to accomplish their tasks.
Answer: A
Explanation:
Grant the operations team access to use Google Cloud Shell.
B (Correct Answer) - Grant the operations engineers access to use Google Cloud Shell.
All the engineer asked is remote access the VMs just like using SSH, so if the machines still have an external IP address, the engineers can access them via SSH using Google Cloud Shell.
This is easies effective way to meet the requirements. All other answers are possible options that might require more setup than worthwhile for your needs.
NEW QUESTION 30
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
- Flow logs are enabled for the VPC subnet, and all firewall rules are
set to log.
- The subnetwork logs are not excluded from Stackdriver.
- The instance that is hosting the application can communicate outside
the subnet.
- Other instances within the subnet can communicate outside the subnet.
- The external resource initiates communication.
What is the most likely cause of the missing log lines?
- A. The traffic is matching the expected egress rule.
- B. The traffic is not matching the expected egress rule.
- C. The traffic is matching the expected ingress rule.
- D. The traffic is not matching the expected ingress rule.
Answer: D
NEW QUESTION 31
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the compute.instanceAdmin to your user account.
- B. Grant the iam.serviceAccountUser to your user account.
- C. Grant the read-only privilege to the service account for the Cloud Storage bucket.
- D. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
Answer: B
NEW QUESTION 32
You have installed Apache Tomcat 8.X on a compute engine in google cloud on port 8085 and you have also installed Jenkins on the same machine on a custom port .You have created a firewall rule that allows traffic to port 8085 .You can see the Apache Tomcat page when you browse X.X.X.X:8085 , but when you browse X.X.X.X:custom port , the Jenkins page doesn't load . What could be the possible solution? Please select the right choice.
- A. Create a firewall rule; select the correct subnet which has the compute engine and allow all protocols and ports .
- B. Create a firewall rule; select the correct network , create a target tag and attach the tag to the compute engine instance and allow traffic to custom port that is mapped with Jenkins.
- C. Create a firewall rule; select the correct network and select the target as all instances in the network and specify the custom port and protocol.
- D. Create a firewall rule; select the correct subnet , create a target tag attach it to the compute engine instance and allow all protocols and ports.
Answer: B
Explanation:
Option B is the Correct choice because, creating a tag and attaching it to the compute engine instance and also allowing traffic to custom port is is less permissive.
Option A is Incorrect because , selecting the target as all instances in the network allows traffic to all instances .
Option C is Incorrect because allowing all protocols and ports is a security scare and always follow principle of least permissive.
Option D is Incorrect because, allowing all protocols and ports could lead to a security disaster, always follow the principle of least permissive.
NEW QUESTION 33
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
- A. GetIamPolicy() via REST API
- B. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
- C. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
- D. gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
- E. setIamPolicy() via REST API
Answer: C,D
NEW QUESTION 34
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
- B. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- C. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
- D. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
Answer: C
Explanation:
https://cloud.google.com/network-connectivity/docs/vpn/concepts/classic-topologies#redundancy-options
NEW QUESTION 35
You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only.
How should you configure your firewall rules?
- A. Create a single firewall rule to allow port 22 with priority 1000.
- B. Create two firewall rules: one to block all traffic with priority 65536, and another to allow port 3389 with priority 1000.
- C. Create two firewall rules: one to block all traffic with priority 0, and another to allow port 22 with priority 1000.
- D. Create a single firewall rule to allow port 3389 with priority 1000.
Answer: A
NEW QUESTION 36
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)
- A. Create network peering between your VPC and BigQuery.
- B. Enable Private Google Access on all the subnets.
- C. Create a Cloud NAT, and route the application traffic via NAT gateway.
- D. Enable Private Services Access on the VPC.
- E. Enable Private Google Access on the VPC.
Answer: C,E
NEW QUESTION 37
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure a global load balancer with the designated IPv6 address.
- B. Create the instance with the designated IPv6 address.
- C. Configure an internal load balancer with the designated IPv6 address.
- D. Configure a TCP Proxy with the designated IPv6 address.
Answer: A
Explanation:
https://cloud.google.com/load-balancing/docs/ipv6
NEW QUESTION 38
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users.
What should you do?
- A. Create a Cloud Armor Policy rule that denies traffic and review necessary logs.
- B. Create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
- C. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to disabled, and review necessary logs.
- D. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to enabled, and review necessary logs.
Answer: B
Explanation:
https://cloud.google.com/armor/docs/security-policy-concepts#preview_mode
NEW QUESTION 39
You are configuring a new instance of Cloud Router in your Organization's Google Cloud environment to allow connection across a new Dedicated Interconnect to your data center Sales, Marketing, and IT each have a service project attached to the Organization's host project.
Where should you create the Cloud Router instance?
- A. VPC network in the IT Project
- B. VPC network in all projects
- C. VPC network in the Host Project
- D. VPC network in the Sales, Marketing, and IT Projects
Answer: C
Explanation:
Reference:
https://cloud.google.com/interconnect/docs/how-to/dedicated/using-interconnects-other-projects
NEW QUESTION 40
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- B. Add a second on-premises VPN gateway with a different public IP address.
Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP. - C. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- D. Add a second Cloud VPN gateway in a different region than the existing VPN gateway.
Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
Answer: A
Explanation:
https://cloud.google.com/vpn/docs/concepts/classic-topologies
NEW QUESTION 41
......
Who should take the Google Professional Cloud Network Engineer exam
Individuals should pursue the Google Professional Cloud Network Engineer Exam if they want to demonstrate their expertise and ability to design, plan, and prototype a GCP Network , implement a GCP Virtual Private Cloud (VPC), implement network security. It's perfect for network engineers, systems administrators or operations team members or simply any professional who wants in on this specific area of IT and cloud.
100% Free Professional-Cloud-Network-Engineer Daily Practice Exam With 80 Questions: https://www.braindumpspass.com/Google/Professional-Cloud-Network-Engineer-practice-exam-dumps.html
Pass Professional-Cloud-Network-Engineer Review Guide, Reliable Professional-Cloud-Network-Engineer Test Engine: https://drive.google.com/open?id=1YdyOjqTwcRf9JDjV9-TOVz_Fy5TDn4WX
