PCNE practice questions 251–255

1. Question 251 · 255 in bank

   Your company is implementing new rules for outbound internet traffic in your Google Cloud environment. You need to design a configuration that enables all outbound internet traffic from virtual machines tagged with production-critical to route through a Secure Web Proxy (SWP) for inspection while allowing all other virtual machines to egress directly to the internet. What should you do?

   • ADeploy a Cloud NAT gateway configured to translate and forward traffic from production-critical VMs to the internet.
   • BConfigure a custom static route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP address as a next hop.
   • CConfigure a policy-based route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP as a next hop.
   • DConfigure a policy-based route with a source set as the subnets of the production-critical VMs and a destination of 0.0.0.0/0 with the SWP IP as the next hop.

   Show answer

   Answer: C

   Next question

2. Question 252 · 255 in bank

   You manage your company's network security and have noticed unusual outbound traffic from a Compute Engine VM that is part of a production subnet. You suspect the VM may be compromised, because it is attempting to communicate with a malicious external IP address. You want to capture detailed metadata for every IP connection to and from this specific VM. including source/destination IP, port, protocol, and the amount of data transferred. What should you do?

   • A• Enable VPC Flow Logs on the subnet containing the VM. • Set the sampling rate to 1.0 for maximum detail, and filter the logs in Cloud Logging for the VM's IP address.
   • B• Navigate to Network Intelligence Center, and run a new connectivity test for the VM. • Analyze the report to see which configurations are allowing the traffic.
   • C• Use Packet Mirroring to create a real-time copy of all network packets from the suspected VM. • Forward the copies to a collector VM for analysis.
   • D• Create a new egress firewall rule with a priority of 65535 that allows all outbound traffic. • Enable Firewall Rules Logging on this new rule to capture all connection details.

   Show answer

   Answer: A

   Next question

3. Question 253 · 255 in bank

   Your organization has two applications running in separate Google Cloud VPC networks (vpc-a and vpc-b) in different projects. You need to establish a secure, private, and encrypted connection between these two VPCs to allow for inter-VPC communication. You must ensure the solution provides high availability and uses dynamic routing. What should you do?

   • AConfigure VPC Network Peering between the two networks, and adjust firewall rules on both sides to allow the required traffic flow between specific subnets.
   • BIn vpc-a, deploy an internal Application Load Balancer for your application. Use Private Service Connect to publish this service in vpc-a and create a PSC consumer endpoint in vpc-b.
   • CIn each VPdeploy a Classic VPN gateway and use a pre-shared key for authentication. Configure static routes to direct traffic to the other VPC.
   • DIn each VPC. deploy an HA VPN gateway and a Cloud Router. Create two VPN tunnels on each gateway, and configure BGP sessions for dynamic routing.

   Show answer

   Answer: D

   Next question

4. Question 254 · 255 in bank

   You are managing a containerized application environment on Google Kubernetes Engine (GKE). You deployed a microservice with a Kubernetes service manifest that defines a named port, http-api, for its main endpoint. You are now configuring an external http(s) load balancer to expose this microservice. You need to ensure the configuration is independent of the actual port number and follows best practices. What should you do?

   • ACreate a backend service that uses the GKE node instance group as its backend, and configure the named port http-api in the backend service.
   • BReference the GCE_VM_IP_PORT network endpoint group (NEG) in the backend configuration that was automatically created for your Kubernetes service, and specify http-api named port for traffic.
   • CAdd an annotation to your Kubernetes service manifest to create a GCE_VM_IP network endpoint group (NEG), and configure the backend service to use this NEG.
   • DAdd an annotation in your Kubernetes ingress manifest to specify the http-api port number directly, and configure the backend service to use this hardcoded port number.

   Show answer

   Answer: A

   Next question

5. Question 255 · 255 in bank

   You are designing a highly resilient and secure connection between an on-premises data center and Google Cloud for a financial services company. The company requires 10 Gbps of bandwidth and mandates that all traffic be encrypted end-to-end between their on-premises network and their Google Cloud VPC. You have already provisioned two 10 Gbps Dedicated Interconnect connections. You need to determine an encryption strategy that meets these requirements and provides redundancy. What should you do?

   • ADeploy four HA VPN gateways on each Dedicated Interconnect connection.
   • BDeploy two HA VPN gateways on each Dedicated Interconnect connection.
   • CConfigure MACsec on each of the Dedicated Interconnect connections.
   • DUse one Dedicated Interconnect for traffic and an HA VPN over the internet for backup.

   Show answer

   Answer: B

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 251. 255 questions available.