PCNE practice questions 221–230

1. Question 221 · 255 in bank

   You recently deployed Cloud VPN to connect your on-premises data canter to Google Cloud. You need to monitor the usage of this VPN and set up alerts in case traffic exceeds the maximum allowed. You need to be able to quickly decide whether to add extra links or move to a Dedicated Interconnect. What should you do?

   • AIn the Network Intelligence Canter, check for the number of packet drops on the VPN.
   • BIn the Google Cloud Console, use Monitoring Query Language to create a custom alert for bandwidth utilization.
   • CIn the Monitoring section of the Google Cloud Console, use the Dashboard section to select a default dashboard for VPN usage.
   • DIn the VPN section of the Google Cloud Console, select the VPN under hybrid connectivity, and then select monitoring to display utilization on the dashboard.

   Show answer

   Answer: B

   Explanation

   A is wrong, Network Intelligence Center, don’t check external connection (https://cloud.google.com/network-intelligence-center) D is wrong, VPN section don’t display monitore utilization. C is wrong, is possible check VPN usage but, question need set up alerts. Letter B is sure for me, we need create custom alert for bandwidth utilization https://cloud.google.com/network-connectivity/docs/vpn/how-to/checking-for-tunnel-overutilization https://cloud.google.com/network-connectivity/docs/vpn/how-to/viewing-logs-metrics#viewing-monitoring-dashboards

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 222 · 255 in bank

   You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?

   • ACreate one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways. Enable global dynamic routing in each VPC.
   • BCreate one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner's VPC. Connect your VPN gateway to your partner's servers.
   • CCreate one OpenVPN Access Server in each region of your VPC and your partner's VPConnect your servers to the partner's servers.
   • DCreate one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways with a pair of tunnels. Enable global dynamic routing in each VPC.

   Show answer

   Answer: D

   Explanation

   100% sure for D. https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview HA VPN requirements Your Cloud VPN configuration must meet the following requirements to achieve a service-level availability of 99.99% for HA VPN: To achieve high availability when both VPN gateways are located in VPC networks, you must use two HA VPN gateways, and both of them must be located in the same region.

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 223 · 255 in bank

   You need to create the network infrastructure to deploy a highly available web application in the us-east1 and us-west1 regions. The application runs on Compute Engine instances, and it does not require the use of a database. You want to follow Google-recommended practices. What should you do?

   • ACreate one VPC with one subnet in each region. Create a regional network load balancer in each region with a static IP address. Enable Cloud CDN on the load balancers. Create an A record in Cloud DNS with both IP addresses for the load balancers.
   • BCreate one VPC with one subnet in each region. Create a global load balancer with a static IP address. Enable Cloud CDN and Google Cloud Armor on the load balancer. Create an A record using the IP address of the load balancer in Cloud DNS.
   • CCreate one VPC in each region, and peer both VPCs. Create a global load balancer. Enable Cloud CDN on the load balancer. Create a CNAME for the load balancer in Cloud DNS.
   • DCreate one VPC with one subnet in each region. Create an HTTP(S) load balancer with a static IP address. Choose the standard tier for the network. Enable Cloud CDN on the load balancer. Create a CNAME record using the load balancer’s IP address in Cloud DNS.

   Show answer

   Answer: B

   Explanation

   D would have been correct if it did not have the Standard network tiering. Remember, standard network tier: Network services such as Cloud Load Balancing are regional (one VIP per region) - https://cloud.google.com/network-tiers C doesn't make sense - You don't need peering with GSLB. This leaves 1 and 2. You need GSLB for CDN. Hence that eliminates A.

   Source: Adapted from community discussion — Thornadoo

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 224 · 255 in bank

   You are the network administrator responsible for hybrid connectivity at your organization. Your developer team wants to use Cloud SQL in the us-west1 region in your Shared VPC. You configured a Dedicated Interconnect connection and a Cloud Router in us-west1, and the connectivity between your Shared VPC and on-premises data center is working as expected. You just created the private services access connection required for Cloud SQL using the reserved IP address range and default settings. However, your developers cannot access the Cloud SQL instance from on-premises. You want to resolve the issue. What should you do?

   • A1. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes. 2. Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.
   • B1. Change the VPC routing mode to global. 2. Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.
   • C1. Create an additional Cloud Router in us-west2. 2. Create a new Border Gateway Protocol (BGP) peering connection to your on-premises data center. 3. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.
   • D1. Change the VPC routing mode to global. 2. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.

   Show answer

   Answer: A

   Explanation

   A is correct. This question is about "Private services access and on-premises connectivity". See this link, https://cloud.google.com/vpc/docs/private-services-access#on-premises-connectivity By default, on-premises hosts can't reach the service producer's network by using private services access. In the VPC network, you might have custom static or dynamic routes to correctly direct traffic to your on-premises network. However, the service producer's network doesn't contain those same routes. When you create a private connection, the VPC network and service producer network exchange subnet routes only. You must export the VPC network's custom routes so that the service provider's network can import them and correctly route traffic to your on-premises network. Update the VPC peering configuration associated with the private connection to export custom routes. Then, https://cloud.google.com/vpc/docs/using-vpc-peering#update-peer-connection Updating a peering connection can import and export custom routes.

   Source: Adapted from community discussion — i_0_i

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 225 · 255 in bank

   You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services. Which session affinity should you choose?

   • ANone
   • BClient IP
   • CClient IP and protocol
   • DClient IP, port and protocol

   Show answer

   Answer: B

   Explanation

   The correct answer is B HTTP/S port 80/443 TFTP port 69 Session affinity, (sticky sessions), overrides the load-balancing algorithm by directing all requests in a session to a specific application server. So, we need a Session affinity by Client IP. Session affinity https://cloud.google.com/load-balancing/docs/backend-service#session_affinity Session affinity options https://cloud.google.com/load-balancing/docs/internal#session_affinity The answer A&D produces the same (Client IP, protocol, and port) by the way.

   Source: Adapted from community discussion — HateMicrosoft

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 226 · 255 in bank

   Your company has separate Virtual Private Cloud (VPC) networks in a single region for two departments: Sales and Finance. The Sales department's VPC network already has connectivity to on-premises locations using HA VPN, and you have confirmed that the subnet ranges do not overlap. You plan to peer both VPC networks to use the same HA tunnels for on-premises connectivity, while providing internet connectivity for the Google Cloud workloads through Cloud NAT. Internet access from the on-premises locations should not flow through Google Cloud. You need to propagate all routes between the Finance department and on-premises locations. What should you do?

   • APeer the two VPCs, and use the default configuration for the Cloud Routers.
   • BPeer the two VPCs, and use Cloud Router’s custom route advertisements to announce the peered VPC network ranges to the on-premises locations.
   • CPeer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network. Use Cloud Router’s custom route advertisements to announce a default route to the on-premises locations.
   • DPeer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network. Use Cloud Router’s custom route advertisements to announce the peered VPC network ranges to the on-premises locations.

   Show answer

   Answer: D

   Explanation

   Option D is the correct answer because it meets all of the requirements mentioned in the scenario. Peering the two VPCs provides connectivity between them without internet traffic flow, and configuring VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network allows for the propagation of all routes between the two VPCs. Finally, using Cloud Router’s custom route advertisements to announce the peered VPC network ranges to the on-premises locations allows for internet access through Cloud NAT while preventing on-premises traffic from flowing through Google Cloud.

   Source: Adapted from community discussion — Komal697

   References

   • Google Cloud documentation

   Next question

7. Question 227 · 255 in bank

   You recently noticed a recurring daily spike in network usage in your Google Cloud project. You need to identify the virtual machine (VM) instances and type of traffic causing the spike in traffic utilization while minimizing the cost and management overhead required. What should you do?

   • AEnable VPC Flow Logs and send the output to BigQuery for analysis.
   • BEnable Firewall Rules Logging for all allowed traffic and send the output to BigQuery for analysis.
   • CConfigure Packet Mirroring to send all traffic to a VM. Use Wireshark on the VM to identity traffic utilization for each VM in the VPC.
   • DDeploy a third-party network appliance and configure it as the default gateway. Use the third-party network appliance to identify users with high network traffic.

   Show answer

   Answer: A

   Explanation

   A is correct. Option B, enabling Firewall Rules Logging for all allowed traffic, would not necessarily capture all traffic, as not all traffic may be subject to firewall rules. Additionally, this approach could generate a large amount of log data, which could be costly and difficult to manage. Option C, configuring Packet Mirroring to send all traffic to a VM running Wireshark, would also generate a large amount of data to analyze, and would require setting up additional resources and infrastructure. Option D, deploying a third-party network appliance and configuring it as the default gateway, would also be costly and require additional management overhead.

   Source: Adapted from community discussion — Ben756

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 228 · 255 in bank

   You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on- premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team’s requirements?

   • A1. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range. 2. Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
   • B1. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range. 2. Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
   • C1. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google's private AP address range. 2. Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
   • D1. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range. 2. Create a custom route that points Google's private API address range to the default internet gateway as the next hop.

   Show answer

   Answer: A

   Explanation

   It can't be C or D: "Choose restricted.googleapis.com when you only need access to Google APIs and services that are supported by VPC Service Controls." I would go for A.

   Source: Adapted from community discussion — al_zo

   References

   • Google Cloud documentation

   Next question

9. Question 229 · 255 in bank

   You have deployed an HTTP(s) load balancer, but health checks to port 80 on the Compute Engine virtual machine instance are failing, and no traffic is sent to your instances. You want to resolve the problem. Which commands should you run?

   • Agcloud compute instances add-access-config instance-1
   • Bgcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --destination-ranges 130.211.0.0/22,35.191.0.0/16 --direction EGRESS
   • Cgcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --source-ranges 130.211.0.0/22,35.191.0.0/16 --direction INGRESS
   • Dgcloud compute health-checks update http health-check --unhealthy-threshold 10

   Show answer

   Answer: C

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 230 · 255 in bank

    You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?

    • AAdd a firewall rule that allows port 443 from the other spoke projects.
    • BEnable Private Google Access on the subnet where the GKE nodes are deployed.
    • CConfigure the authorized networks to be the subnet ranges of the other spoke projects.
    • DDeploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.

    Show answer

    Answer: D

    Explanation

    Agree D is right To enable access such as in hub-and-spoke designs, create a proxy hosted in authorized IP address space, because VPC network peering is non-transitive.

    Source: Adapted from community discussion — nosense

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 221. 255 questions available.