PCNE practice questions 151–160

1. Question 151 · 255 in bank

   You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem. What should you do?

   • AApply an additional IAM role to the Google API's service account to allow custom mode networks.
   • BUpdate the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
   • CExplicitly reference the custom mode networks in the Cloud Armor whitelist.
   • DExplicitly reference the custom mode networks in the Deployment Manager templates.

   Show answer

   Answer: D

   Explanation

   My vote goes to D as well. "After you convert an auto mode network to custom mode, you must review all API calls and gcloud commands that implicitly reference any subnet that was automatically created while the network was in auto mode. API calls and commands will need to be modified so that they reference the subnet explicitly." https://cloud.google.com/vpc/docs/using-vpc#switch-network-mode

   Source: Adapted from community discussion — ThisisJohn

   References

   • Google Cloud documentation

   Next question

2. Question 152 · 255 in bank

   Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead. How should you design the topology?

   • ACreate a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
   • BCreate 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
   • CCreate 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
   • DCreate a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.

   Show answer

   Answer: C

   Explanation

   Best answer is C C. A. Not correct. Shared VPC work to connect resources from different project. Since requirements. state "single project for 3 separate departments", shared VPC would not work here. B. Not correct since Cloud VPN is used to connect peer networks traffic over Internet. C. Correct. D. Possible but it would incur in operational overhead if we compare with C.

   Source: Adapted from community discussion — B3nd3cida

   References

   • Google Cloud documentation

   Next question

3. Question 153 · 255 in bank

   Select 2

   You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member. Which two methods can you use to accomplish this? (Choose two.)

   • AGetIamPolicy() via REST API
   • BsetIamPolicy() via REST API
   • Cgcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
   • Dgcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
   • EEnter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.

   Show answer

   Answer: BD

   Explanation

   Correct Answer are (D) & (E) GetIamPolicy and SetIamPolicy is only for service accounts. But question asks for a project members. Hence, D and E are correct ans. D - https://cloud.google.com/iam/docs/granting-changing-revoking-access#granting-gcloud-manual E - https://cloud.google.com/iam/docs/granting-changing-revoking-access#access-control-via-console

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 154 · 255 in bank

   You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection. What should you do on your on-premises servers?

   • ATune TCP parameters on the on-premises servers.
   • BCompress files using utilities like tar to reduce the size of data being sent.
   • CRemove the -m flag from the gsutil command to enable single-threaded transfers.
   • DUse the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].

   Show answer

   Answer: A

   Explanation

   Correct Answer is (A) As the question states that the RTT is 100ms thus low transfer rate is due to the TCP window size that is too small. And the solution is to increase the window size .

   Source: Adapted from community discussion — ESP_SAP

   Next question

5. Question 155 · 255 in bank

   You work for a multinational enterprise that is moving to GCP. These are the cloud requirements: "¢ An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup) "¢ Multiple regional offices in Europe and APAC "¢ Regional data processing is required in europe-west1 and australia-southeast1 "¢ Centralized Network Administration Team Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us- west1. What should you do?

   • A"¢ Create 2 VPCs in a Shared VPC Host Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Host Project. "¢ Attach NIC0 in VPC #1 us-west1 subnet of the Host Project. "¢ Attach NIC1 in VPC #2 us-west1 subnet of the Host Project. "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.
   • B"¢ Create 2 VPCs in a Shared VPC Host Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Service Project. "¢ Attach NIC0 in VPC #1 us-west1 subnet of the Host Project. "¢ Attach NIC1 in VPC #2 us-west1 subnet of the Host Project. "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.
   • C"¢ Create 1 VPC in a Shared VPC Host Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Host Project. "¢ Attach NIC0 in us-west1 subnet of the Host Project. "¢ Attach NIC1 in us-west1 subnet of the Host Project "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.
   • D"¢ Create 1 VPC in a Shared VPC Service Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Service Project. "¢ Attach NIC0 in us-west1 subnet of the Service Project. "¢ Attach NIC1 in us-west1 subnet of the Service Project "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.

   Show answer

   Answer: A

   Explanation

   Correct Answer is (A): You cannot attach 2 NICs of same appliance to same VPC. The two NICs must be attached to different VPCs. It cant be C or D because you need 2 VPCs. https://cloud.google.com/vpc/docs/create-use-multiple-interfaces Each interface is attached to a different VPC network, giving that instance access to different VPC networks in Google Cloud Platform (GCP). You cannot attach multiple network interfaces to the same VPC network. It can't be B because you need to deploy the appliances in HOST Project to achieve CENTRALIZED NETWORK ADMINISTRATION

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 156 · 255 in bank

   You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption. How should you design this topology?

   • ACreate a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
   • BCreate a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
   • CUse gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
   • DUse gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.

   Show answer

   Answer: A

   Explanation

   Correct Answer is (A): The service range setting is permanent and cannot be changed. Please see https://stackoverflow.com/questions/60957040/how-to-increase-the-service-address-range-of-a-gke-cluster I think the correc tanswer is A since: Grow is expected to up to 100 nodes (that would be /25), then up to 200 pods per node (100 times 200 = 20000 so /17 is 32768), then 1500 services in a /21 (up to 2048)

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation

   Next question

7. Question 157 · 255 in bank

   Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates. Which Google Cloud load balancer should you use?

   • ASSL proxy load balancer
   • BNetwork load balancer
   • CHTTPS load balancer
   • DTCP proxy load balancer

   Show answer

   Answer: D

   Explanation

   D should be the answer. "Globally distributed users report that their SMTP and IMAP services are slow" --> means it's needed to be global, traffic type is TCP. "end-to-end encryption" +"you do not have access to the SSL certificates" ---> means that you can not use client certificate to configure on LB to do SSL offload. As per the reference below, only TCP proxy Load Balancer. https://cloud.google.com/load-balancing/docs/choosing-load-balancer

   Source: Adapted from community discussion — densnoigaskogen

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 158 · 255 in bank

   Select 2

   Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs. Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)

   • AVPC peering
   • BShared VPC
   • CCloud VPN
   • DDedicated Interconnect
   • ECloud NAT

   Show answer

   Answer: AC

   Explanation

   Correct Answer are (A) & (C): The solution is incorrect. GCP recommends creating VPC peering for establishing communication between two organizations in GCP.

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 159 · 255 in bank

   You have a storage bucket that contains the following objects: [1] [1] [1] [1] Cloud CDN is enabled on the storage bucket, and all four objects have been successfully cached. You want to remove the cached copies of all the objects with the prefix folder-a, using the minimum number of commands. What should you do?

   • AAdd an appropriate lifecycle rule on the storage bucket.
   • BIssue a cache invalidation command with pattern /folder-a/*.
   • CMake sure that all the objects with prefix folder-a are not shared publicly.
   • DDisable Cloud CDN on the storage bucket. Wait 90 seconds. Re-enable Cloud CDN on the storage bucket.

   Show answer

   Answer: B

   Explanation

   Correct Answer is (B): You might want to remove an object from the cache prior to its normal expiration time. You can force an object or set of objects to be ignored by the cache by requesting a cache invalidation. Path patterns Each invalidation request specifies a path pattern that identifies the object or set of objects that should be invalidated. The path pattern can be either a specific path, such as /cat.jpg, or an entire directory structure, such as /pictures/*. The following rules apply to path patterns: The path pattern must start with /. It cannot include ? or #. It must not include an * except as the final character following a /. If it ends with /*, the preceding string is a prefix, and all objects whose paths begin with that prefix are invalidated.

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • AWS documentation

   Next question

10. Question 160 · 255 in bank

    Select 2

    Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances. Which two products should you incorporate into the solution? (Choose two.)

    • AVPC flow logs
    • BFirewall logs
    • CCloud Audit logs
    • DStackdriver Trace
    • ECompute Engine instance system logs

    Show answer

    Answer: AB

    Explanation

    Correct Answers are (A) & (B): A: Using VPC Flow Logs VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes. These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization. https://cloud.google.com/vpc/docs/using-flow-logs (B): Firewall Rules Logging overview Firewall Rules Logging allows you to audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Firewall Rules Logging is also useful if you need to determine how many connections are affected by a given firewall rule. You enable Firewall Rules Logging individually for each firewall rule whose connections you need to log. Firewall Rules Logging is an option for any firewall rule, regardless of the action (allow or deny) or direction (ingress or egress) of the rule. https://cloud.google.com/vpc/docs/firewall-rules-logging

    Source: Adapted from community discussion — ESP_SAP

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 151. 255 questions available.