PCNE practice questions 21–30

1. Question 21 · 255 in bank

   You are migrating a three-tier application architecture from on-premises to Google Cloud. As a first step in the migration, you want to create a new Virtual Private Cloud (VPC) with an external HTTP(S) load balancer. This load balancer will forward traffic back to the on-premises compute resources that run the presentation tier. You need to stop malicious traffic from entering your VPC and consuming resources at the edge, so you must configure this policy to filter IP addresses and stop cross-site scripting (XSS) attacks. What should you do?

   • ACreate a Google Cloud Armor policy, and apply it to a backend service that uses an unmanaged instance group backend.
   • BCreate a hierarchical firewall ruleset, and apply it to the VPC's parent organization resource node.
   • CCreate a Google Cloud Armor policy, and apply it to a backend service that uses an internet network endpoint group (NEG) backend.
   • DCreate a VPC firewall ruleset, and apply it to all instances in unmanaged instance groups.

   Show answer

   Answer: C

   Explanation

   C because XSS is block by cloud armor. A not correct because unmanaged instance group are only for VM that reside in a single project, zone, VPC network, and subnet. https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-unmanaged-instances

   Source: Adapted from community discussion — Laryoul

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 22 · 255 in bank

   You just finished your company’s migration to Google Cloud and configured an architecture with 3 Virtual Private Cloud (VPC) networks: one for Sales, one for Finance, and one for Engineering. Every VPC contains over 100 Compute Engine instances, and now developers using instances in the Sales VPC and the Finance VPC require private connectivity between each other. You need to allow communication between Sales and Finance without compromising performance or security. What should you do?

   • AConfigure an HA VPN gateway between the Finance VPC and the Sales VPC.
   • BConfigure the instances that require communication between each other with an external IP address.
   • CCreate a VPC Network Peering connection between the Finance VPC and the Sales VPC.
   • DConfigure Cloud NAT and a Cloud Router in the Sales and Finance VPCs.

   Show answer

   Answer: C

   Next question

3. Question 23 · 255 in bank

   You have provisioned a Partner Interconnect connection to extend connectivity from your on-premises data center to Google Cloud. You need to configure a Cloud Router and create a VLAN attachment to connect to resources inside your VPC. You need to configure an Autonomous System number (ASN) to use with the associated Cloud Router and create the VLAN attachment. What should you do?

   • AUse a 4-byte private ASN 4200000000-4294967294.
   • BUse a 2-byte private ASN 64512-65535.
   • CUse a public Google ASN 15169.
   • DUse a public Google ASN 16550.

   Show answer

   Answer: D

   Explanation

   seems that D Create Cloud Routers For Partner Interconnect, all Cloud Routers must have a local ASN of 16550. source: https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/partner-creating-9999-availability

   Source: Adapted from community discussion — nosense

   References

   • Google Cloud documentation

   Next question

4. Question 24 · 255 in bank

   You want to create a service in GCP using IPv6. What should you do?

   • ACreate the instance with the designated IPv6 address.
   • BConfigure a TCP Proxy with the designated IPv6 address.
   • CConfigure a global load balancer with the designated IPv6 address.
   • DConfigure an internal load balancer with the designated IPv6 address.

   Show answer

   Answer: C

   Explanation

   Choose option C. Global Load Balancer: Global Load Balancers in GCP are capable of handling both IPv4 and IPv6 traffic. They provide a single anycast IP address for the service, which can be accessed globally. This is a suitable option for creating a service accessible over IPv6. Options A and B seem to be referring to individual instances or proxies, and they might not provide the global reach and load balancing capabilities that a global load balancer offers. Option D (Configure an internal load balancer) is not the best fit if you want to expose the service to the internet using IPv6, as internal load balancers are typically used for internal-facing services within a Virtual Private Cloud (VPC). Therefore, configuring a global load balancer (option C) is the most appropriate choice for creating a service in GCP that is accessible over IPv6.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 25 · 255 in bank

   You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?

   • AUse global SSL Proxy Load Balancing with backends in both regions.
   • BUse global TCP Proxy Load Balancing with backends in both regions.
   • CUse global external HTTP(S) Load Balancing with backends in both regions.
   • DUse Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.

   Show answer

   Answer: D

   Explanation

   TCP pass-through = A, B and C is wrong, because they make ssl offloading. In this requirement, only Letter D is possible. External LB with support a TCP pass-through. https://cloud.google.com/load-balancing/docs/choosing-load-balancer https://cloud.google.com/load-balancing/docs/network

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 26 · 255 in bank

   In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subnet-a. You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers. What should you do?

   • ACreate network tag app-server and service account sa-db@my-project.iam.gserviceaccount.com. Add the tag to the application servers, and associate the service account with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-rule \ --action allow \ --direction ingress \ --rules top:3306 \ --source-tags app-server \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
   • BCreate service accounts sa-app@my-project.iam.gserviceaccount.com and sa-db@my-project.iam.gserviceaccount.com. Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-ru --allow TCP:3306 \ --source-service-accounts sa-app@democloud-idp- demo.iam.gserviceaccount.com \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
   • CCreate service accounts sa-app@my-project.iam.gserviceaccount.com and sa-db@my-project.iam.gserviceaccount.com. Associate the service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-ru --allow TCP:3306 \ --source-ranges 10.128.0.0/20 \ --source-service-accounts sa-app@my- project.iam.gserviceaccount.com \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
   • DCreate network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-rule \ --action allow \ --direction ingress \ --rules tcp:3306 \ --source-ranges 10.128.0.0/20 \ --source-tags app-server \ --target-tags db-server

   Show answer

   Answer: B

   Explanation

   C and D is wrong, source address can be subnet-b (172.16.0.0/24) A is wrong, syntax error. B is correct, https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 27 · 255 in bank

   You are planning a large application deployment in Google Cloud that includes on-premises connectivity. The application requires direct connectivity between workloads in all regions and on-premises locations without address translation, but all RFC 1918 ranges are already in use in the on-premises locations. What should you do?

   • AUse multiple VPC networks with a transit network using VPC Network Peering.
   • BUse overlapping RFC 1918 ranges with multiple isolated VPC networks.
   • CUse overlapping RFC 1918 ranges with multiple isolated VPC networks and Cloud NAT.
   • DUse non-RFC 1918 ranges with a single global VPC.

   Show answer

   Answer: D

   Explanation

   B and C can’t connect to on premise with those requirements. A no make sense. For me, is D. Creating non-RFC 1918 address space in VPC is possible, but is required accept EULA check box, test it in your lab.

   Source: Adapted from community discussion — ccieman2016

   Next question

8. Question 28 · 255 in bank

   Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only. What should you do?

   • ACreate an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
   • BCreate an allow on match egress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
   • CCreate an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP ports 80 and 443.
   • DCreate an allow on match egress firewall rule with the target tag “web-server" to allow web server IP addresses for TCP ports 80 and 443.

   Show answer

   Answer: C

   Next question

9. Question 29 · 255 in bank

   You successfully provisioned a single Dedicated Interconnect. The physical connection is at a colocation facility closest to us-west2. Seventy-five percent of your workloads are in us-east4, and the remaining twenty-five percent of your workloads are in us-central1. All workloads have the same network traffic profile. You need to minimize data transfer costs when deploying VLAN attachments. What should you do?

   • AKeep the existing Dedicated interconnect. Deploy a VLAN attachment to a Cloud Router in us-west2, and use VPC global routing to access workloads in us-east4 and us-central1.
   • BKeep the existing Dedicated Interconnect. Deploy a VLAN attachment to a Cloud Router in us-east4, and deploy another VLAN attachment to a Cloud Router in us-central1.
   • COrder a new Dedicated Interconnect for a colocation facility closest to us-east4, and use VPC global routing to access workloads in us-central1.
   • DOrder a new Dedicated Interconnect for a colocation facility closest to us-central1, and use VPC global routing to access workloads in us-east4.

   Show answer

   Answer: B

   Explanation

   B is the better option. VM in same continent, regional routing Cloud Interconnect egress charges for North America No region-to-region egress charges You order an Interconnect connection running from your on-premises location to San Jose (SJC) and create two VLAN attachments over that connection. One VLAN attachment goes to region us-east1, and the other VLAN attachment goes to region us-west1. If you send traffic from a VM in us-east1 or from a VM in us-west1 to your on-premises location over your Interconnect connection in SJC, you are charged the following rates: Cloud Interconnect egress charges for North America (because that is where the Interconnect connection is located). You are not charged region-to-region egress charges because the VMs are using a VLAN attachment in the same region. https://cloud.google.com/network-connectivity/docs/interconnect/pricing#regional-routing

   Source: Adapted from community discussion — mity99

   References

   • Google Cloud documentation

   Next question

10. Question 30 · 255 in bank

    You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?

    • A1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC. 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Configure VPC peering in the spoke VPCs to peer with the hub VPC.
    • B1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. 2. Associate the zone with the hub VPC. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke PCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
    • C1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC. 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Create a hub-and-spoke VPN deployment in each spoke VPC to connect back to the on-premises network directly.
    • D1. Create a private forwarding zone in Cloud DNS for ‘corp altostrat.com’ called corp-altostrat-com that points to 192. 168.20.88. Associate the zone with the hub VPC. 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Sat a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Create a hub and spoke VPN deployment in each spoke VPC to connect back to the hub VPC.

    Show answer

    Answer: A

    Explanation

    C and D is wrong, hub-and-spoke vpn deployment. B is wrong, when create forwarding zone is required associate zone with VPC, not after create. A is complete, and correct. 100% A, I tested in my lab.

    Source: Adapted from community discussion — ccieman2016

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 21. 255 questions available.