PCNE practice questions 241–250

1. Question 241 · 255 in bank

   Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?

   • AConfigure HA VPN by using high availability gateways and tunnels.
   • BConfigure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.
   • CConfigure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.
   • DConfigure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.

   Show answer

   Answer: D

   Next question

2. Question 242 · 255 in bank

   Your company’s web application was just deployed on Compute Engine VMS in multiple Google Cloud regions. You have created multiple instance groups and you need to distribute traffic between these VMs. You want your users to automatically connect to the backend that is located in the closest region while following Google-recommended practices. What should you do?

   • ACreate one global external Application Load Balancer and multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
   • BCreate one global external Application Load Balancer and one backend service with multiple backends. Point each backend to a different instance group.
   • CCreate two global external Application Load Balancers with one backend service and one backend. Point each back end to a different instance group.
   • DCreate two global external Application Load Balancers with multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.

   Show answer

   Answer: B

   Next question

3. Question 243 · 255 in bank

   Your company uses Network Connectivity Center to connect its VPCs in Google Cloud. They plan to connect their on-premises data center to one of these VPCs by using HA VPN. The CIDR range of your on-premises network overlaps with the IP addresses in Google Cloud. You want your VMs in Google Cloud to connect directly to the IP address of the on-premises hosts. What should you do?

   • AConfigure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud application load balancer.
   • CConfigure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud TCP proxy load balancer.
   • DConfigure a subnet of purpose PRIVATE_NAT and use Private NAT for the Network Connectivity Center spokes.
   • EConfigure a subnet of purpose PRIVATE_NAT and use Hybrid NAT.

   Show answer

   Answer: E

   Next question

4. Question 244 · 255 in bank

   Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two VLAN attachments. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?

   • ACreate an HA VPN gateway and associate the gateway with your two VLAN attachments. Use the existing Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
   • BCreate an HA VPN gateway and associate the gateway with your two VLAN attachments. Create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
   • CEnable MACsec on the VLAN attachments.
   • DEnable MACsec on Partner Cloud Interconnect.

   Show answer

   Answer: B

   Next question

5. Question 245 · 255 in bank

   Your organization wants to deploy an internal application named app-1 in VPC-1. The application will consume services from another internal application named app-2 in VPC-2. VPC Network Peering will connect both applications. You need to apply microsegmentation between these two applications and VPCs. What should you do?

   • AAssign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
   • BAssign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
   • CAssign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure an ingress VPC firewall rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
   • DAssign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a network firewall policy that is attached to VPC-2 with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.

   Show answer

   Answer: D

   Next question

6. Question 246 · 255 in bank

   You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. The connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?

   • ACreate a Connectivity Test. Review the results for configuration issues in the VPC routing table.
   • BEnable and review Cloud Logging for Cloud Armor. Look for logs with errors that match the destination IP address of the public SaaS provider.
   • CEnable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider.
   • DEnable the Firewall Insights API. Set the Deny rule insights observation period to one day. Review Insight results to assure there are no firewall rules denying traffic.

   Show answer

   Answer: C

   Next question

7. Question 247 · 255 in bank

   You are designing a Google Kubernetes Engine cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 Services. Because of the migration of new Services over the next two years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 Services. You want to use VPC-native clusters with alias IP address ranges, while minimizing address consumption. How should you design this topology?

   • ACreate a subnet of size /28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the Services are ready to be deployed, resize the subnets.
   • BUse gcloud container clusters create [CLUSTER_NAME]--enable-ip-alias to create a VPC-native Cluster.
   • CCreate a subnet of size /25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
   • DUse gcloud container clusters create [CLUSTER_NAME] to create a VPC-native Cluster.

   Show answer

   Answer: C

   Next question

8. Question 248 · 255 in bank

   Your organization is migrating workloads from AWS to Google Cloud. Because a particularly critical workload will take longer to migrate, you need to set up Google Cloud CDN and point it to the existing application at AWS. What should you do?

   • A• Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
   • B• Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to a passthrough Network Load Balancer as a target pool. • Enable Cloud CDN on the target pool.
   • C• Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to a passthrough Network Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
   • D• Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.

   Show answer

   Answer: A

   Next question

9. Question 249 · 255 in bank

   Your company utilizes Network Connectivity Center (NCC) to facilitate communication between numerous spoke VPCs. A development team reports that their application instances in app-dev-spoke-vpc are unable to connect to a new database service located in db-dev-spoke-vpc. You need to diagnose this issue using an observability tool and determine the root cause. What should you do?

   • AUse Firewall Insights to analyze the firewall rule configuration and modify the appropriate rule.
   • BCheck each firewall rule in both the app-dev-spoke-vpc and db-dev-spokevpc.
   • CVerify that the application instances in app-dev-spoke-vpc connected to Network Connectivity Center are assigned external IP addresses to reach the database service.
   • DUse Network Intelligence Center’s Connectivity Tests to perform a reachability analysis between an instance in app-dev-spoke-vpc and the database service in db-dev-spoke-vpc.

   Show answer

   Answer: D

   Next question

10. Question 250 · 255 in bank

    Your company acquired a new division. The new division's network team requires complete control over their networking infrastructure. You need to extend your existing Google Cloud network infrastructure, that consists of a single VPC, to allow workloads from all divisions to communicate with each other. You want to avoid incurring extra costs and granting unnecessary permissions to the new division's networking team. What should you do?

    • A• Create a new project for the new division's network team. • Create a new VPC within the new project. • Establish a VPC peering between your existing VPC and the new division’s VPC. • Create a new subnet dedicated to the new division's workloads. • Grant roles/compute.networkUser on the new project to the new division’s network team group.
    • B• Create a new project for the new division's network team. • Create a new VPC within the new project. • Establish a VPC peering between your existing VPC and the new division’s VPC. • Grant roles/compute.networkAdmin on the newly created project to the new division's network team group.
    • C• Ensure that the project hosting the existing network infrastructure is enabled as a host project. • Create a new subnet dedicated to the new division's workloads in the existing VPC. • Grant roles/compute.networkUser on the newly created subnet to the new division’s network team group.
    • D• Create a new project for the new division's network team. • Create a new VPC within the new project. • Establish a VPN connection between your existing VPC and the new division's VPC. • Grant roles/compute.networkAdmin on the newly created project to the new division's network team group.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 241. 255 questions available.