100% Pass Your Professional-Cloud-Network-Engineer Exam Dumps at First Attempt with PracticeVCE
Penetration testers simulate Professional-Cloud-Network-Engineer exam PDF
NEW QUESTION 42
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Disable DNSSEC at your domain registar.
- B. Transfer ownership of the domain to a new registar.
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone. - C. Update the TTL for the zone.
- D. Set the zone to the TRANSFER state.
Answer: A
NEW QUESTION 43
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices.
How should you design this topology?
- A. Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- B. Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
- C. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
- D. Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 44
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost.
Which two steps should you take? (Choose two.)
- A. Connect the VPCs in project code-dev and data-dev using VPC Network Peering.
- B. Enable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-dev) a service project.
- C. Create a route in the code-dev project to the destination prefixes in project data-dev and use nexthop as the default gateway, and vice versa.
- D. Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
- E. Connect both projects using Cloud VPN.
Answer: A,D
NEW QUESTION 45
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?
- A. Service Project Admin privileges from the Shared VPC Admin.
- B. Organization Admin privileges from the Organization Admin.
- C. Shared VPC Admin privileges from the Organization Admin.
- D. Security Admin privileges from the Shared VPC Admin.
Answer: D
Explanation:
https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 46
You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicy permission, and try again.
- B. Add the resourcemanager.projects.get permission, and try again.
- C. Try again with a different role with a new name but the same permissions.
- D. Remove the resourcemanager.projects.list permission, and try again.
Answer: D
Explanation:
Reference:
https://cloud.google.com/iam/docs/understanding-custom-roles
NEW QUESTION 47
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Manually patch some of the instances, and then perform a rolling restart on the instance group.
- B. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
- C. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
- D. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
Answer: B
NEW QUESTION 48
You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider.
Which connection type should you choose?
- A. Dedicated Interconnect
- B. Partner Interconnect
- C. Carrier Peering
- D. Direct Peering
Answer: D
Explanation:
When established, Direct Peering provides a direct path from your on-premises network to Google services, including Google Cloud products that can be exposed through one or more public IP addresses. Traffic from Google's network to your on-premises network also takes that direct path, including traffic from VPC networks in your projects. Google Cloud customers must request that direct egress pricing be enabled for each of their projects after they have established Direct Peering with Google. For more information, see Pricing.
NEW QUESTION 49
Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances.
Which two products should you incorporate into the solution? (Choose two.)
- A. Compute Engine instance system logs
- B. Cloud Audit logs
- C. Firewall logs
- D. Stackdriver Trace
- E. VPC flow logs
Answer: B,D
NEW QUESTION 50
You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours.
Which connectivity method should you choose?
- A. Dedicated Interconnect, but don't provision any VLAN attachments
- B. 50-Mbps Partner VLAN attachment
- C. Cloud VPN
- D. Dedicated Interconnect with a single VLAN attachment
Answer: C
NEW QUESTION 51
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:
* IP ranges for pods and services must be as small as possible.
* The nodes and the master must not be reachable from the internet.
* You must be able to use kubectl commands from on-premises subnets to manage the cluster.
How should you create the GKE cluster?
- A. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable privateEndpoint on the cluster master.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - B. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable a GKE cluster network policy, set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - C. * Create a VPC-native GKE cluster using GKE-managed IP ranges.
* Set the pod IP range as /21 and service IP range as /24.
* Set up a network proxy to access the master. - D. * Create a private cluster that uses VPC advanced routes.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips
NEW QUESTION 52
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
* Your ISP is a Google Partner Interconnect provider.
* Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.
* A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses.
* Most of the data transfer will be from GCP to the on-premises environment.
* The application can burst up to 1.5 Gbps during peak transfers over the Interconnect.
* Cost and the complexity of the solution should be minimal.
How should you provision the connectivity solution?
- A. Provision a Partner Interconnect through your ISP.
- B. Use network compression over your VPN to increase the amount of data you can send over your VPN.
- C. Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
- D. Provision a Dedicated Interconnect instead of a VPN.
Answer: C
NEW QUESTION 53
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- B. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- C. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- D. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
Answer: A
Explanation:
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration.
This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network.
https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
NEW QUESTION 54
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-pathto a specific URL used for health checking, and set proxy-headerto PROXY_V1.
- B. Set request-path to a specific URL used for health checking, and set responseto a string that the backend service will always return in the response body.
- C. Set proxy-header to the default value, and set hostto include a custom host header that identifies the health check.
- D. Set request-path to a specific URL used for health checking, and set hostto include a custom host header that identifies the health check.
Answer: D
Explanation:
https://cloud.google.com/load-balancing/docs/health-checks
NEW QUESTION 55
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
- A. Cloud NAT
- B. Dedicated Interconnect
- C. VPC peering
- D. Cloud VPN
- E. Shared VPC
Answer: B,D
NEW QUESTION 56
One instance in your VPC is configured to run with a private IP address only. You want to ensure that even if this instance is deleted, its current private IP address will not be automatically assigned to a different instance.
In the GCP Console, what should you do?
- A. Assign a public IP address to the instance.
- B. Assign a new reserved internal IP address to the instance.
- C. Add custom metadata to the instance with key internal-address and value reserved.
- D. Change the instance's current internal IP address to static.
Answer: B
NEW QUESTION 57
......
All Professional-Cloud-Network-Engineer Dumps and Training Courses: https://www.practicevce.com/Google/Professional-Cloud-Network-Engineer-practice-exam-dumps.html
Help candidates to study and pass the Google Cloud Certified - Professional Cloud Network Engineer Exams hassle-free: https://drive.google.com/open?id=1ZVNzVtGklK4cqmn9kqSr2tIsPFoJOepR