Real Exam Questions Professional-Cloud-Network-Engineer Dumps Exam Questions in here [Oct-2021]
Get Latest Oct-2021 Conduct effective penetration tests using Professional-Cloud-Network-Engineer
NEW QUESTION 33
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- B. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- C. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
- D. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 34
You have configured Cloud CDN using HTTP(S) load balancing as the origin for cacheable content. Compression is configured on the web servers, but responses served by Cloud CDN are not compressed.
What is the most likely cause of the problem?
- A. You have to configure the web servers to compress responses even if the request has a Via header.
- B. You have configured the web servers and Cloud CDN with different compression types.
- C. The web servers behind the load balancer are configured with different compression types.
- D. You have not configured compression in Cloud CDN.
Answer: A
Explanation:
If responses served by Cloud CDN are not compressed but should be, check that the web server software running on your instances is configured to compress responses. By default, some web server software will automatically disable compression for requests that include a Via header. The presence of a Via header indicates the request was forwarded by a proxy. HTTP proxies such as HTTP(S) load balancing add a Via header to each request as required by the HTTP specification. To enable compression, you may have to override your web server's default configuration to tell it to compress responses even if the request had a Via header.
NEW QUESTION 35
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale.
How should you provision your instances?
- A. Create an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.
- B. Create an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.
- C. Create a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.
- D. Create a single managed instance group, specify the desired region, and select Multiple zones for the location.
Answer: C
NEW QUESTION 36
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?
- A. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
- B. Create unique DNS records for each service that sends traffic to the desired IP address.
- C. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
- D. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
Answer: B
NEW QUESTION 37
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?
- A. Create network tags to allow connectivity between all three VPCs.
- B. Alter the routing table to resolve the asymmetric route.
- C. Delete the legacy network and recreate it to allow transitive peering.
- D. Configure VPC peering in a full mesh.
Answer: D
Explanation:
https://cloud.google.com/vpc/docs/using-vpc-peering
NEW QUESTION 38
Your company has launched a mobile application that uploads pictures to google cloud storage bucket. The application was successfully uploading the pictures to google cloud storage buckets, but lately the application has become popular and you start seeing 429 errors. Please suggest the ways to address the issue. Please select any two.
- A. Use truncated exponential backoff
- B. Use the correct verb with the /upload or /download URLs.
- C. The OAuth access token has expired and needs to be refreshed.
- D. Throttle your client's requests
Answer: A
Explanation:
Option A and Option B are the Correct choices because , a 429 error is caused by Too Many Requests.If your application tries to use more than its limit, additional requests will fail. Throttle your client's requests, and/or use truncated exponential backoff.
Option C is Incorrect choice because, a OAuth access token has expiry would result in error
401(Unauthorized)
Option D is Incorrect because, using wrong verb with /upload or /download URLs would lead to
405 (method not allowed error).
NEW QUESTION 39
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- B. Generate a new SSH key pair. Verify the format of the private key and add it to the instance.
SSH into the instance using a third-party tool like putty or ssh. - C. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- D. Generate a new SSH key pair. Verify the format of the public key and add it to the project.
SSH into the instance using a third-party tool like putty or ssh.
Answer: C
Explanation:
https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION 40
You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)
- A. Turn on Private Google Access at the subnet level.
- B. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
- C. Turn on Private Google Access at the VPC level.
- D. Turn on Private Services Access at the VPC level.
- E. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
Answer: A,E
Explanation:
https://cloud.google.com/vpc/docs/private-access-options#pga Private Google Access VM instances that only have internal IP addresses (no external IP addresses) can use Private Google Access. They can reach the _external IP addresses_ of Google APIs and services.
NEW QUESTION 41
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.
- B. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
- C. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
- D. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
Answer: C
NEW QUESTION 42
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service.
What should you do?
- A. Create IPTables firewall rules that block all traffic except for the traffic-scrubbing service.
- B. Create a VPC Service Control Perimeter that blocks all traffic except for the traffic-scrubbing service.
- C. Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.
- D. Create a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.
Answer: C
Explanation:
Global load balancer will proxy the connection . thus no trace of session origin IP. you should use Cloud Armor to geofence your service.
https://cloud.google.com/load-balancing/docs/https
NEW QUESTION 43
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
- B. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
- C. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- D. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
Answer: A
Explanation:
https://link.springer.com/chapter/10.1007/978-1-4842-1004-8_4
NEW QUESTION 44
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command.
Which next hop should you choose?
- A. The name and region of the Cloud VPN tunnel
- B. The default internet gateway
- C. The IP address of the instance on the remote side of the VPN tunnel
- D. The IP address of the Cloud VPN gateway
Answer: A
Explanation:
When you create a route based tunnel using the Cloud Console, Classic VPN performs both of the following tasks: Sets the tunnel's local and remote traffic selectors to any IP address (0.0.0.0/0) For each range in Remote network IP ranges, Google Cloud creates a custom static route whose destination (prefix) is the range's CIDR, and whose next hop is the tunnel. https://cloud.google.com/network-connectivity/docs/vpn/how-to/creating-static-vpns
NEW QUESTION 45
You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.
What should you do?
- A. Try connecting to the instance via SSH, and check the logs.
- B. Create a new firewall rule to allow traffic from port 22, and enable logs.
- C. Check the VPC flow logs for the instance.
- D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
Answer: C
NEW QUESTION 46
You work for a university that is migrating to GCP.
These are the cloud requirements:
* On-premises connectivity with 10 Gbps
* Lowest latency access to the cloud
* Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost- efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
- B. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- C. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
- D. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
Answer: B
NEW QUESTION 47
After a network change window one of your company's applications stops working. The application uses an on-premises database server that no longer receives any traffic from the application. The database server IP address is 10.2.1.25. You examine the change request, and the only change is that 3 additional VPC subnets were created. The new VPC subnets created are 10.1.0.0/16, 10.2.0.0/16, and 10.3.1.0/24/ The on-premises router is advertising 10.0.0.0/8.
What is the most likely cause of this problem?
- A. The less specific VPC subnet route is taking priority.
- B. The on-premises router is not advertising a route for the database server.
- C. A cloud firewall rule that blocks traffic to the on-premises database server was created during the change.
- D. The more specific VPC subnet route is taking priority.
Answer: C
NEW QUESTION 48
You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application.
Which type of load balancer should you use?
- A. Internal TCP/UDP load balancer
- B. TCP/SSL proxy load balancer
- C. Network load balancer
- D. HTTP(S) load balancer
Answer: A
NEW QUESTION 49
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Add a second on-premises VPN gateway with a different public IP address.
Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP. - B. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- C. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- D. Add a second Cloud VPN gateway in a different region than the existing VPN gateway.
Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
Answer: C
Explanation:
https://cloud.google.com/vpn/docs/concepts/classic-topologies
NEW QUESTION 50
You want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN. You need to restrict reachability over the tunnel to specific local subnets, and you do not have a device capable of speaking Border Gateway Protocol (BGP).
Which routing option should you choose?
- A. Dynamic routing using Cloud Router
- B. Policy-based routing using the default local traffic selector
- C. Policy-based routing using a custom local traffic selector
- D. Route-based routing using default traffic selectors
Answer: C
NEW QUESTION 51
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure a global load balancer with the designated IPv6 address.
- B. Create the instance with the designated IPv6 address.
- C. Configure a TCP Proxy with the designated IPv6 address.
- D. Configure an internal load balancer with the designated IPv6 address.
Answer: A
Explanation:
https://cloud.google.com/load-balancing/docs/ipv6
NEW QUESTION 52
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
- A. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
- B. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
- C. Rename the default VPC as "Distribution" and peer it via network peering.
- D. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
Answer: D
Explanation:
https://cloud.google.com/vpc/docs/vpc#ip-ranges
NEW QUESTION 53
......
Authentic Best resources for Professional-Cloud-Network-Engineer Online Practice Exam: https://www.dumps4pdf.com/Professional-Cloud-Network-Engineer-valid-braindumps.html
Get the superior quality Professional-Cloud-Network-Engineer Dumps with explanations waiting just for you, get it now: https://drive.google.com/open?id=1Z_PElBBdNpXWZqPgM4ViHNj4LaZCoKH4