PCNE practice questions 171–180

1. Question 171 · 255 in bank

   You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly. How should you configure the health check?

   • ASet request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
   • BSet request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
   • CSet request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
   • DSet proxy-header to the default value, and set host to include a custom host header that identifies the health check.

   Show answer

   Answer: C

   Explanation

   Answer is C: https://cloud.google.com/load-balancing/docs/health-checks#optional-flags-hc-protocol-http https://cloud.google.com/load-balancing/docs/health-checks Request path and Response: For HTTP, HTTPS, and HTTP2 protocols, you can optionally provide a URL path for the health check probe systems to contact.

   Source: Adapted from community discussion — desertlotus1211

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 172 · 255 in bank

   You need to give each member of your network operations team least-privilege access to create, modify, and delete Cloud Interconnect VLAN attachments. What should you do?

   • AAssign each user the editor role.
   • BAssign each user the compute.networkAdmin role.
   • CGive each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get.
   • DGive each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update.

   Show answer

   Answer: B

   Explanation

   D is also incorrect. The question requires the "delete" permissions. The compute/networkAdmin role is the only one that offers this ability.

   Source: Adapted from community discussion — jonclem

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 173 · 255 in bank

   You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template. How should you update your instances?

   • AManually patch some of the instances, and then perform a rolling restart on the instance group.
   • BUsing the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
   • CDeploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
   • DPerform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.

   Show answer

   Answer: D

   Explanation

   "C" is correct. We perform a canary update if we have tested the new feature heavily. However, we have not tested heavily in this scenario. So we have to test the new feature and new template at first and have to MINIMIZE impacts to users. There are some impacts on users if there are some bugs on its template and we test on a canary update. There is no impact on users if we test the new instances in the new instance group which is not provided to users. So "D" has more impacts on users than "C". "C" is the least impactful way for users to test and update instances.

   Source: Adapted from community discussion — ydanno

   References

   • Google Cloud documentation

   Next question

4. Question 174 · 255 in bank

   You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC. How should you configure the Distribution VPC?

   • ACreate the Distribution VPC in auto mode. Peer both the VPCs via network peering.
   • BCreate the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
   • CCreate the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
   • DRename the default VPC as "Distribution" and peer it via network peering.

   Show answer

   Answer: B

   Explanation

   It has to be custom mode to avoid collision but in case of C 10.128.0.0/9 will collide with the ranges automatically created. 10.0.0.0/9 doesn’t overlap with them. https://cloud.google.com/vpc/docs/vpc#ip-ranges

   Source: Adapted from community discussion — jordi_194

   References

   • Google Cloud documentation

   Next question

5. Question 175 · 255 in bank

   Your company runs an enterprise platform on-premises using virtual machines (VMs). Your internet customers have created tens of thousands of DNS domains pointing to your public IP addresses allocated to the VMs. Typically, your customers hard-code your IP addresses in their DNS records. You are now planning to migrate the platform to Compute Engine and you want to use Bring Your Own IP. You want to minimize disruption to the platform. What should you do?

   • ACreate a VPC and request static external IP addresses from Google Cloud. Assign the IP addresses to the Compute Engine instances. Notify your customers of the new IP addresses so they can update their DNS records.
   • BVerify ownership of your IP addresses. After the verification, Google Cloud advertises and provisions the IP prefix for you. Assign the IP addresses to the Compute Engine instances.
   • CCreate a VPC with the same IP address range as your on-premises network. Assign the IP addresses to the Compute Engine instances.
   • DVerify ownership of your IP addresses. Use live migration to import the prefix. Assign the IP addresses to the Compute Engine instances.

   Show answer

   Answer: B

   Next question

6. Question 176 · 255 in bank

   You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale. How should you provision your instances?

   • ACreate a single managed instance group, specify the desired region, and select Multiple zones for the location.
   • BCreate a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.
   • CCreate an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.
   • DCreate an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.

   Show answer

   Answer: A

   Explanation

   To increase application availability and ensure autoscaling, it is recommended to use managed instance groups and select multiple zones for the location. This allows for automatic scaling and distribution of instances across multiple zones within a region, providing better availability and redundancy. By using a single managed instance group, it simplifies the deployment and management of instances, and also ensures that instances are evenly distributed across zones for optimal availability.

   Source: Adapted from community discussion — Komal697

   References

   • Google Cloud documentation

   Next question

7. Question 177 · 255 in bank

   You need to create the technical architecture for hybrid connectivity from your data center to Google Cloud. This will be managed by a partner. You want to follow Google-recommended practices for production-level applications. What should you do?

   • AAsk the partner to install two security appliances in the data center. Configure one VPN connection from each of these devices to Google Cloud, and ensure that the VPN devices on-premises are in separate racks on separate power and cooling systems.
   • BConfigure two Partner Interconnect connections in one metropolitan area (metro). Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in a single region, and configure regional dynamic routing on the VPC.
   • CConfigure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure global dynamic routing on the VPC.
   • DConfigure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure regional dynamic routing on the VPC.

   Show answer

   Answer: C

   Next question

8. Question 178 · 255 in bank

   You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin. What should you do?

   • AEnsure that the object you don't want to be cached anymore is not shared publicly.
   • BCreate a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the private attribute.
   • CAdd an appropriate lifecycle rule on the storage bucket containing the two objects.
   • DAdd a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.

   Show answer

   Answer: D

   Explanation

   option D, "Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies," is the correct answer because it adds a header to the object's metadata that tells the CDN not to cache the object and to always fetch it from the origin server. Invalidating previously cached copies is also important to ensure that users are not served stale or outdated content.

   Source: Adapted from community discussion — Komal697

   References

   • Google Cloud documentation

   Next question

9. Question 179 · 255 in bank

   Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service. What should you do?

   • ACreate a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.
   • BCreate a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.
   • CCreate a VPC Service Control Perimeter that blocks all traffic except for the traffic-scrubbing service.
   • DCreate IPTables firewall rules that block all traffic except for the traffic-scrubbing service.

   Show answer

   Answer: A

   Explanation

   Reading this leads me to believe A The below links outlines NAT behavior of GCP global load balancer. Since this is a full proxy, the source IP of the scrubbing source would be translated to GFE IP, so allowing the scrubbing source via FW rule would not work. So, by elimination this tells me that cloudarmor is the answer! So A https://cloud.google.com/load-balancing/docs/https

   Source: Adapted from community discussion — Hybrid_Cloud_boy

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 180 · 255 in bank

    Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications: ✑ Your ISP is a Google Partner Interconnect provider. ✑ Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps. ✑ A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses. ✑ Most of the data transfer will be from GCP to the on-premises environment. ✑ The application can burst up to 1.5 Gbps during peak transfers over the Interconnect. ✑ Cost and the complexity of the solution should be minimal. How should you provision the connectivity solution?

    • AProvision a Partner Interconnect through your ISP.
    • BProvision a Dedicated Interconnect instead of a VPN.
    • CCreate multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
    • DUse network compression over your VPN to increase the amount of data you can send over your VPN.

    Show answer

    Answer: A

    Explanation

    Answer is A, cost and complexity of multiple tunnel vpn is very high, also , dedicated interconnect is not required as required max speed is 1.5gbps Also , direct connectivity is bogus verb, all the solution provide direct connectivity to your vpc instance , once connected through router

    Source: Adapted from community discussion — garbad

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 171. 255 questions available.