PCNE practice questions 231–240

1. Question 231 · 255 in bank

   You recently deployed your application in Google Cloud. You need to verify your Google Cloud network configuration before deploying your on-premises workloads. You want to confirm that your Google Cloud network configuration allows traffic to flow from your cloud resources to your on- premises network. This validation should also analyze and diagnose potential failure points in your Google Cloud network configurations without sending any data plane test traffic. What should you do?

   • AUse Network Intelligence Center's Connectivity Tests.
   • BEnable Packet Mirroring on your application and send test traffic.
   • CUse Network Intelligence Center's Network Topology visualizations.
   • DEnable VPC Flow Logs and send test traffic.

   Show answer

   Answer: C

   Explanation

   Using Network Topology provides the following benefits: You can view the topology of your deployments. No additional configurations or agents are required to use Network Topology. You can use Network Topology graphs to understand your Google Cloud infrastructure. You don't need to view multiple logs or use third-party tools. You can use Network Topology to help you analyze the performance of your network. You can drill down and view various metrics that can help you identify unexpected patterns. You can use filters to help you highlight and focus on specific resources, especially when you need to diagnose and troubleshoot issues. You can view cross-project metrics for network traffic sent across Shared VPC or VPC Network Peering boundaries within the same organization. You can view insights for entities with high egress metric values for further analysis and troubleshooting.

   Source: Adapted from community discussion — didek1986

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 232 · 255 in bank

   In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost: • Port 8080 should always be open for VMs in the projects in the Dev folder. • Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder. What should you do?

   • ACreate and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
   • BCreate a Shared VPC for the Dev projects and a Shared VPC for the Prod projects. Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared VPCs.
   • CIn all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
   • DUse Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 233 · 255 in bank

   Your company’s on-premises network is connected to a VPC using a Cloud VPN tunnel. You have a static route of 0.0.0.0/0 with the VPN tunnel as its next hop defined in the VPC. All internet bound traffic currently passes through the on-premises network. You configured Cloud NAT to translate the primary IP addresses of Compute Engine instances in one region. Traffic from those instances will now reach the internet directly from their VPC and not from the on-premises network. Traffic from the virtual machines (VMs) is not translating addresses as expected. What should you do?

   • ALower the TCP Established Connection Idle Timeout for the NAT gateway.
   • BAdd firewall rules that allow ingress and egress of the external NAT IP address, have a target tag that is on the Compute Engine instances, and have a priority value higher than the priority value of the default route to the VPN gateway.
   • CAdd a default static route to the VPC with the default internet gateway as the next hop, the network tag associated with the Compute Engine instances, and a higher priority than the priority of the default route to the VPN tunnel.
   • DIncrease the default min-ports-per-vm setting for the Cloud NAT gateway.

   Show answer

   Answer: C

   Explanation

   A and D no make sense for me, because Cloud NAT is manage service by GCP, adjusts theses especific parameter, non sense. B is wrong, you cannot adjust firewall rules. for me, letter C is correct.

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation

   Next question

4. Question 234 · 255 in bank

   You are designing a Partner Interconnect hybrid cloud connectivity solution with geo-redundancy across two metropolitan areas. You want to follow Google-recommended practices to set up the following region/metro pairs: • (region 1/metro 1) • (region 2/metro 2) What should you do?

   • ACreate a Cloud Router in region 1 with two VLAN attachments connected to metro1-zone1-x. Create a Cloud Router in region 2 with two VLAN attachments connected to metro1-zone2-x.
   • BCreate a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone1-x. Create a Cloud Router in region 2 with two VLAN attachments connected to metro2-zone2-x.
   • CCreate a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone2-x. Create a Cloud Router in region 2 with one VLAN attachment connected to metro2-zone2-x.
   • DCreate a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone1-x and one VLAN attachment connected to metro1-zone2-x. Create a Cloud Router in region 2 with one VLAN attachment connected to metro2-zone1-x and one VLAN attachment to metro2-zone2-x.

   Show answer

   Answer: D

   Explanation

   Option D is correct because it follows the recommended practice of having geo-redundancy across two metropolitan areas, with each Cloud Router having one VLAN attachment in each metro. This provides redundancy in case of a failure in one of the metros. Option A is incorrect because it has two VLAN attachments in the same metro, which does not provide the desired level of redundancy. Option B is incorrect because it has only one VLAN attachment in one of the metros, which also does not provide the desired level of redundancy. Option C is incorrect because it has only one VLAN attachment in each metro, which again does not provide the desired level of redundancy.

   Source: Adapted from community discussion — Komal697

   References

   • Google Cloud documentation

   Next question

5. Question 235 · 255 in bank

   Your organization is launching a new video game that will be available to all users globally through Cloud CDN. During the earl y release phase, you discovered that the wrong binary version was uploaded from Cloud Storage and cached in Cloud CDN. Thousands of users have downloaded the wrong version. Your marketing department has notified users that this was the wrong version of the game and asked all users to download the updated version using the same URL. You need to ensure users are downloading the updated version of the game. What should you do?

   • ACreate a security policy to block all Cloud CON requests, review the logs, and filter which users are attempting to download the wrong game binary.
   • BCreate a new URL path for the updated game binary. Allow the cache to expire automatically through HTTP headers.
   • CUpload the updated game binary to Cloud Storage. Invalidate the wrong game binary from the Cloud CDN cache.
   • DDisable Cloud CDN. Reconfigure the load balancer with the updated game binary. Enable Cloud CDN.

   Show answer

   Answer: C

   Next question

6. Question 236 · 255 in bank

   You are setting up a Dedicated Interconnect connection from your organization’s on-premises data center in Frankfurt, Germany, towards the europe-west3 region, which is also in the Frankfurt metropolitan area. The AI team lead expressed their concern regarding connectivity to the europe-west4 region because their team wants to use Google Cloud TPUs for their workloads. You need to ensure that low latency network connectivity is established for this team’s workloads. You want to minimize costs and operational overhead. What should you do?

   • ASet up the Dedicated Interconnect connection towards the europe-west4 region instead of the europe-west3 region.
   • BSet up an additional Partner Interconnect connection between your data center and the europe-west4 region.
   • CSet up a remote VLAN attachment to the europe-west4 region on the Dedicated Interconnect connection.
   • DUse Cloud VPN instead of Dedicated Interconnect to send traffic over the internet.

   Show answer

   Answer: C

   Next question

7. Question 237 · 255 in bank

   Your company uses VPC firewall rules and denies all egress traffic. You need to allow some VMs to contact external websites based on their fully qualified domain name (FQDN). You apply the new configuration, but the traffic is still denied. You need to adjust your setup to apply the new configuration. What would you do?

   • ARaise the priority of the network firewall policy rules.
   • BLower the priority of the network firewall policy rules.
   • CUpdate the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL.
   • DUpdate the default policy and rule evaluation order to AFTER_CLASSIC_FIREWALL.

   Show answer

   Answer: C

   Next question

8. Question 238 · 255 in bank

   Your VPC is configured with regional dynamic routing mode. You have deployed VMs and VLAN attachments in the europe-west2 region, and regional internal Application Load Balancers in us-east1. You need to ensure the VMs in the europe-west2 region have connectivity to the regional internal Application Load Balancers in the us-east1 region. What should you do?

   • ACreate the backend in us-east1, create multiple forwarding rules in each region, and then enable regional access.
   • BCreate the backend service in europe-west2, create the forwarding rule in us-east1, and then enable regional access.
   • CCreate the backend service in us-east1, create the forwarding rule in europe-west2, and then enable global access.
   • DCreate the backend service in us-east1, create the forwarding rule in us-east1, and then enable global access.

   Show answer

   Answer: D

   Next question

9. Question 239 · 255 in bank

   You are designing the architecture for your organization so that clients can connect to certain Google APIs. Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?

   • AConfigure Private Google Access on the VPC resource. Create a default route to the internet.
   • BConfigure Private Google Access on the subnet resource. Create a default route to the internet.
   • CConfigure Cloud NAT, and remove the default route to the internet.
   • DConfigure a global Secure Web Proxy, and remove the default route to the internet.

   Show answer

   Answer: B

   Next question

10. Question 240 · 255 in bank

    You have configured a single IPSec Cloud VPN tunnel for your organization to one of your customers. The VPN Tunnel Status is showing as Established; however the BGP Session Status is showing as BGP not configured. Your customer’s BGP settings are: • Customer BGP address: 169.254.11.1/30 • Customer ASN: 64515 • Google Cloud BGP address: 169.254.11.2 • Google Cloud ASN: 64517 • MD5 Authentication: Disabled You need to configure your local BGP session for this tunnel based on the settings provided by the third party customer. You have already associated the Cloud Router with the Cloud VPN Tunnel. What should you do?

    • ACreate a BGP session with these settings: • Peer ASN: 64517 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
    • BCreate a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.1 • Peer BGP IP: 169.254.11.2 • MD5 Authentication: Disabled.
    • CCreate a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
    • DCreate a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 1000 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Enabled.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 231. 255 questions available.