PCNE practice questions 181–190

1. Question 181 · 255 in bank

   Select 2

   Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it as a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost. Which two steps should you take? (Choose two.)

   • AUse Cloud Armor to blacklist the attacker's IP addresses.
   • BIncrease the maximum autoscaling backend to accommodate the severe bursty traffic.
   • CCreate a global HTTP(s) load balancer and move your application backend to this load balancer.
   • DShut down the entire application in GCP for a few hours. The attack will stop when the application is offline.
   • ESSH into the backend compute engine instances, and view the auth logs and syslogs to further understand the nature of the attack.

   Show answer

   Answer: AC

   Explanation

   A & C Cloud Armor is the solution to prevent and mitigate attack (DDOS SQL injection and so on), it's a revenue generating so have to be alive and protected. No Cloud Armor is not a firewall. Using the CA language you have tons of prebuild rules to evaluate and block the malicious traffic in automatic way. You can put the rule blocking a specific traffic but it's not there the value (you have the firewall for that). Than you need C cause Cloud Armor require an HTTP(s) load balancer (that can be used cause it's a web application)

   Source: Adapted from community discussion — Alex_74

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 182 · 255 in bank

   Select 2

   You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses. Which two actions should you take? (Choose two.)

   • AActivate the Service Networking API in your project.
   • BActivate the Cloud Datastore API in your project.
   • CCreate a private connection to a service producer.
   • DCreate a custom static route to allow the traffic to reach the Cloud SQL API.
   • EEnable Private Google Access.

   Show answer

   Answer: AC

   Explanation

   Answer are A & C C is definitely correct. private services access require private connection In below links stated Service Networking API is required https://cloud.google.com/service-infrastructure/docs/enabling-private-services-access

   Source: Adapted from community discussion — mlyu

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 183 · 255 in bank

   You want to use Cloud Interconnect to connect your on-premises network to a GCP VPC. You cannot meet Google at one of its point-of-presence (POP) locations, and your on-premises router cannot run a Border Gateway Protocol (BGP) configuration. Which connectivity model should you use?

   • ADirect Peering
   • BDedicated Interconnect
   • CPartner Interconnect with a layer 2 partner
   • DPartner Interconnect with a layer 3 partner

   Show answer

   Answer: D

   Explanation

   The answer is D. https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview For Layer 3 connections, your service provider establishes a BGP session between your Cloud Routers and their edge routers for each VLAN attachment. You don't need to configure BGP on your on-premises router. Google and your service provider automatically set the correct configurations.

   Source: Adapted from community discussion — porsak

   References

   • Google Cloud documentation

   Next question

4. Question 184 · 255 in bank

   You have configured a Compute Engine virtual machine instance as a NAT gateway. You execute the following command: gcloud compute routes create no-ip-internet-route \ --network custom-network1 \ --destination-range 0.0.0.0/0 \ --next-hop instance nat-gateway \ --next-hop instance-zone us-central1-a \ --tags no-ip --priority 800 You want existing instances to use the new NAT gateway. Which command should you execute?

   • Asudo sysctl -w net.ipv4.ip_forward=1
   • Bgcloud compute instances add-tags [existing-instance] --tags no-ip
   • Cgcloud builds submit --config=cloudbuild.waml --substitutions=TAG_NAME=no-ip
   • Dgcloud compute instances create example-instance --network custom-network1 \ --subnet subnet-us-central \ --no-address \ --zone us-central1-a \ --image-family debian-9 \ --image-project debian-cloud \ --tags no-ip

   Show answer

   Answer: B

   Explanation

   This command adds the "no-ip" tag to the existing instances, allowing them to use the newly created NAT gateway. The routing rule you created with the gcloud compute routes create command specifies the next hop instance as the NAT gateway instance, and the tag "no-ip" is required to match the route. Option A enables IP forwarding on the NAT gateway instance, which is already required to function as a NAT gateway, but it does not help to configure the routing of the existing instances. Option C submits a Cloud Build job to build and deploy an application or infrastructure defined in a YAML file. This option is not related to configuring the routing of existing instances to use a NAT gateway. Option D creates a new instance and applies the "no-ip" tag to it, but it does not help to configure the routing of existing instances.

   Source: Adapted from community discussion — Komal697

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 185 · 255 in bank

   You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command. Which next hop should you choose?

   • AThe default internet gateway
   • BThe IP address of the Cloud VPN gateway
   • CThe name and region of the Cloud VPN tunnel
   • DThe IP address of the instance on the remote side of the VPN tunnel

   Show answer

   Answer: C

   Explanation

   Correct Answer is (C): When you create a route based tunnel using the Cloud Console, Classic VPN performs both of the following tasks: Sets the tunnel's local and remote traffic selectors to any IP address (0.0.0.0/0) For each range in Remote network IP ranges, Google Cloud creates a custom static route whose destination (prefix) is the range's CIDR, and whose next hop is the tunnel. https://cloud.google.com/network-connectivity/docs/vpn/how-to/creating-static-vpns

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 186 · 255 in bank

   You need to enable Cloud CDN for all the objects inside a storage bucket. You want to ensure that all the object in the storage bucket can be served by the CDN. What should you do in the GCP Console?

   • ACreate a new cloud storage bucket, and then enable Cloud CDN on it.
   • BCreate a new TCP load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
   • CCreate a new SSL proxy load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
   • DCreate a new HTTP load balancer, select the storage bucket as a backend, enable Cloud CDN on the backend, and make sure each object inside the storage bucket is shared publicly.

   Show answer

   Answer: D

   Explanation

   CDN needs a LB to serve a bucket, plus of course it needs to be publicly visible, otherwise you can't serve it to the public! https://cloud.google.com/cdn/docs/setting-up-cdn-with-bucket

   Source: Adapted from community discussion — BenMS

   References

   • Google Cloud documentation

   Next question

7. Question 187 · 255 in bank

   Select 2

   You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall. Which two actions should you take? (Choose two.)

   • ATurn on Private Google Access at the subnet level.
   • BTurn on Private Google Access at the VPC level.
   • CTurn on Private Services Access at the VPC level.
   • DCreate a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
   • ECreate a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.

   Show answer

   Answer: AD

   Explanation

   ANS is A,D. Ref.: https://cloud.google.com/vpc/docs/configure-private-google-access https://cloud.google.com/vpc/docs/private-access-options "By default, when a Compute Engine VM lacks an external IP address assigned to its network interface, it can only send packets to other internal IP address destinations. You can allow these VMs to connect to the set of external IP addresses used by Google APIs and services by enabling Private Google Access on the subnet used by the VM's network interface."

   Source: Adapted from community discussion — EJJ

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • developers.google.com documentation

   Next question

8. Question 188 · 255 in bank

   Your company's Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure: /fr/video /en/video /es/video /../video /fr/audio /en/audio /es/audio /../audio Which solution should you recommend?

   • ARearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio/*.
   • BRearrange the directory structure, create DNS hostname entries for video and audio and leverage a path rule such as /video/* and /audio/*.
   • CLeave the directory structure as-is, create a URL map and leverage a path rule such as \/[a-z]{2}\/video and \/[a-z]{2}\/audio.
   • DLeave the directory structure as-is, create a URL map and leverage a path rule such as /*/video and /*/audio.

   Show answer

   Answer: A

   Explanation

   Correct Answer is (A): Path matcher constraints Path matchers and path rules have the following constraints: A path rule can only include a wildcard character (*) after a forward slash character (/). For example, /videos/* and /videos/hd/* are valid for path rules, but /videos* and /videos/hd* are not. Path rules do not use regular expression or substring matching. For example, path rules for either /videos/hd or /videos/hd/* do not apply to a URL with the path /video/hd-abcd. However, a path rule for /video/* does apply to that path. https://cloud.google.com/load-balancing/docs/url-map-concepts#pm-constraints

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 189 · 255 in bank

   You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider. Which connection type should you choose?

   • ACarrier Peering
   • BDirect Peering
   • CDedicated Interconnect
   • DPartner Interconnect

   Show answer

   Answer: B

   Explanation

   When established, Direct Peering provides a direct path from your on-premises network to Google services, including Google Cloud products that can be exposed through one or more public IP addresses. Traffic from Google's network to your on-premises network also takes that direct path, including traffic from VPC networks in your projects. Google Cloud customers must request that direct egress pricing be enabled for each of their projects after they have established Direct Peering with Google. For more information, see Pricing. https://cloud.google.com/network-connectivity/docs/direct-peering

   Source: Adapted from community discussion — majun

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 190 · 255 in bank

    Your organization is developing a landing zone architecture with the following requirements: • There should be no communication possible between production and non-production en-vironments. • Communication between applications within an environment may be necessary. • Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules. • Each application should be billed separately. • Developers of an application within a project should have the autonomy to create their compute resources. They should not create or modify networking resources. • Up to 1000 applications are expected per environment. You need to create a design that accommodates these requirements. What should you do?

    • ACreate a design that has one Shared VPC host project for the production environment, and another Shared VPC host project for the nonproduction environment. Associate the various applications' service projects with the corresponding environment's host project.
    • BCreate a design that has a Shared VPC for each project. Implement hierarchical firewall policies to apply micro-segmentation between VPCs.
    • CCreate a design that implements a single Shared VPUse VPC firewall rules with secure tags to enforce micro-segmentation between environments.
    • DCreate a design where each project in each environment has its own VPC with its own subnets, routes, and firewall rules. Ensure all VPCs are added as spokes to a Network Connectivity Center hub.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 181. 255 questions available.