Google Professional-Cloud-Network-Engineer Professional Cloud Network Engineer Exam Exam Practice Test Questions

• Question 1

  Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments.* Each organization has enabled full connectivity between all of its projects by using Shared VPC.* Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.* There are no prefix overlaps between the two organizations.* Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.* Neither organization has Interconnects to their on-premises environment.You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.Which two steps should you take? (Choose two.)

  • Provision Cloud Interconnect to connect both organizations together.
  • Set up some variant of DNS forwarding and zone transfers in each organization.
  • Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
  • Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
  • Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC.

  Show Answer Answer: B, C Next

• Question 2

  In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost:Port 8080 should always be open for VMs in the projects in the Dev folder.Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder.What should you do?

  • Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
  • Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects. Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared VPCs.
  • In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
  • Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.

  Show Answer Answer: A Next

• Question 3

  You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even though the cluster is up and running.What should you do to solve the problem?

  • Assign a public IP address to the instance.
  • Create a route to reach the Master, pointing to the default internet gateway.
  • Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.
  • Create the appropriate master authorized network entries to allow the instance to communicate to the master.

  Show Answer Answer: D Next

• Question 4

  You are planning a large application deployment in Google Cloud that includes on-premises connectivity. The application requires direct connectivity between workloads in all regions and on-premises locations without address translation, but all RFC 1918 ranges are already in use in the on-premises locations. What should you do?

  • Use multiple VPC networks with a transit network using VPC Network Peering.
  • Use overlapping RFC 1918 ranges with multiple isolated VPC networks.
  • Use overlapping RFC 1918 ranges with multiple isolated VPC networks and Cloud NAT.
  • Use non-RFC 1918 ranges with a single global VPC.

  Show Answer Answer: D Next

• Question 5

  You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?

  • Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways. Enable global dynamic routing in each VPC.
  • Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner's VPC. Connect your VPN gateway to your partner's servers.
  • Create one OpenVPN Access Server in each region of your VPC and your partner's VPC. Connect your servers to the partner's servers.
  • Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways with a pair of tunnels. Enable global dynamic routing in each VPC.

  Show Answer Answer: A Next