PCNE practice questions 41–50

1. Question 41 · 255 in bank

   You are responsible for enabling Private Google Access for the virtual machine (VM) instances in your Virtual Private Cloud (VPC) to access Google APIs. All VM instances have only a private IP address and need to access Cloud Storage. You need to ensure that all VM traffic is routed back to your on-premises data center for traffic scrubbing via your existing Cloud Interconnect connection. However, VM traffic to Google APIs should remain in the VPC. What should you do?

   • A1. Delete the default route in your VPC. 2. Create a private Cloud DNS zone for googleapis.com, create a CNAME for *.googleapis.com to restricted googleapis.com, and create an A record for restricted googleapis com that resolves to the addresses in 199.36.153.4/30. 3. Create a static route in your VPC for the range 199.36.153.4/30 with the default internet gateway as the next hop.
   • B1. Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP). 2. Create a public Cloud DNS zone with a CNAME for *.google.com to private googleapis com, create a CNAME for * googleapis.com to private googleapis com, and create an A record for Private googleapis.com that resolves to the addresses in 199.36.153 8/30. 3. Create a static route in your VPC for the range 199 .36.153.8/30 with the default internet gateway as the next hop.
   • C1. Configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP) with a lower priority (MED) than the default VPC route. 2. Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to private googleapis com, and create an A record for private.googleapis.com that resolves to the addresses in 199 .36.153.8/30. 3. Create a static route in your VPC for the range 199.36. 153.8/30 with the default internet gateway as the next hop.
   • D1. Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP). 2. Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to Private googleapis.com, and create an A record for private.googleapis.com that resolves to the addresses in 199.36.153.8/30. 3. Create a static route in your VPC for the range 199.36.153.8/30 with the default internet gateway as the next hop.

   Show answer

   Answer: D

   Explanation

   Sometimes, you might want traffic to be directed to your on-premises network by default. To do that, you can advertise a default route from your on-premises router to Cloud Router. With Cloud Router, you don't need to create and manage static routes. If you advertise a default route from your on-premises network, check that it's prioritized over other automatically created default routes (has a lower MED value) https://cloud.google.com/network-connectivity/docs/router/concepts/overview#priority-and-dynamic-routing If you go with above, then it is inclined to C

   Source: Adapted from community discussion — TD24

   References

   • Google Cloud documentation

   Next question

2. Question 42 · 255 in bank

   You are designing a hub-and-spoke network architecture for your company’s cloud-based environment. You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access. The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5. What should you do?

   • A1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. 4. Import the custom routes in the spokes.
   • B1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes. 4. Delete the default internet gateway route of the spokes.
   • C1. Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes.
   • D1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Create a new route in the spoke VPC that points to IP address 10.0.0.5.

   Show answer

   Answer: B

   Explanation

   B. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes. 4. Delete the default internet gateway route of the spokes. Example architecture using VPC Network Peering and internal TCP/UDP load balancer as next hop This architecture is a typical use case for enterprise environments, using the internal TCP/UDP load balancer for high availability, combined with VPC Network Peering for attaching network segments. The default route to the internet gateway in the spoke ***** VPC networks is deleted.

   Source: Adapted from community discussion — pk349

   Next question

3. Question 43 · 255 in bank

   You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the on-premises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel. Which filter should you use in Cloud Logging to examine the logs?

   • Aresource.type= “gce_router”
   • Bresource.type= “gce_network_region”
   • Cresource.type= “vpn_tunnel”
   • Dresource.type= “vpn_gateway”

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 44 · 255 in bank

   Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from on-premises locations using Cloud Interconnect connections. Your company must be able to send traffic to Cloud Storage only through the Interconnect links while accessing other Google APIs and services over the public internet. What should you do?

   • AUse the default public domains for all Google APIs and services.
   • BUse Private Service Connect to access Cloud Storage, and use the default public domains for all other Google APIs and services.
   • CUse Private Google Access, with restricted.googleapis.com virtual IP addresses for Cloud Storage and private.googleapis.com for all other Google APIs and services.
   • DUse Private Google Access, with private.googleapis.com virtual IP addresses for Cloud Storage and restricted.googleapis.com virtual IP addresses for all other Google APIs and services.

   Show answer

   Answer: B

   Explanation

   Based on this doc: https://cloud.google.com/vpc/docs/private-service-connect#endpoints "Private Service Connect endpoint can be used to access Google APIs such as Cloud Storage or BigQuery. This functionality is similar to Private Google Access, except that you can use your own internal IP addresses for endpoints." private.googleapis.com can't be reached through the internet since it's just reached within Google Cloud Networks

   Source: Adapted from community discussion — waelghaith

   References

   • Google Cloud documentation

   Next question

5. Question 45 · 255 in bank

   Your organization has a Google Cloud Virtual Private Cloud (VPC) with subnets in us-east1, us-west4, and europe-west4 that use the default VPC configuration. Employees in a branch office in Europe need to access the resources in the VPC using HA VPN. You configured the HA VPN associated with the Google Cloud VPC for your organization with a Cloud Router deployed in europe-west4. You need to ensure that the users in the branch office can quickly and easily access all resources in the VPC. What should you do?

   • ACreate custom advertised routes for each subnet.
   • BConfigure each subnet’s VPN connections to use Cloud VPN to connect to the branch office.
   • CConfigure the VPC dynamic routing mode to Global.
   • DSet the advertised routes to Global for the Cloud Router.

   Show answer

   Answer: C

   Next question

6. Question 46 · 255 in bank

   Select 2

   Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments. "¢ Each organization has enabled full connectivity between all of its projects by using Shared VPC. "¢ Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic. "¢ There are no prefix overlaps between the two organizations. "¢ Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space. "¢ Neither organization has Interconnects to their on-premises environment. You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime. Which two steps should you take? (Choose two.)

   • AProvision Cloud Interconnect to connect both organizations together.
   • BSet up some variant of DNS forwarding and zone transfers in each organization.
   • CConnect VPCs in both organizations using Cloud VPN together with Cloud Router.
   • DUse Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
   • ECreate a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC.

   Show answer

   Answer: BC

   Explanation

   This is a case of needing to read the question carefully and not dive straight into the Google docs, as they may not be relevant in some cases: Two key points here: Both orgs are using a custom DNS solution (i.e. Not Cloud DNS) Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. By process of elimination. A) Is incorrect as you don't use an interconnect for connecting two GCP orgs D) Is incorrect, as Cloud DNS isn't being used E) Isn't correct, as a third org would require a new domain and host names etc., and both orgs are retaining the domains etc. for a year. This leaves us with B and C, which are both valid answers. B. Set up some variant of DNS forwarding and zone transfers in each organization. C. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.

   Source: Adapted from community discussion — KingCartman

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 47 · 255 in bank

   Your organization uses a Shared VPC architecture with a host project and three service projects. You have Compute Engine instances that reside in the service projects. You have critical workloads in your on-premises data center. You need to ensure that the Google Cloud instances can resolve on-premises hostnames via the Dedicated Interconnect you deployed to establish hybrid connectivity. What should you do?

   • A1. Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the private zone to the on-premises DNS servers. 2. In your Cloud Router, add a custom route advertisement for the IP 35.199.192.0/19 to the on-premises environment.
   • B1. Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the Private zone to the on-premises DNS servers. 2. In your Cloud Router, add a custom route advertisement for the IP 169.254 169.254 to the on-premises environment.
   • C1. Configure a Cloud DNS private zone in the host project of the Shared VPC. 2. Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project 3. In your Cloud Router, add a custom route advertisement for the IP 169.254 169 254 to the on-premises environment.
   • D1.Configure a Cloud DNS private zone in the host project of the Shared VPC. 2. Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project. 3. Configure a DNS policy in the Shared VPC to allow inbound query forwarding with your on-premises DNS server as the alternative DNS server.

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 48 · 255 in bank

   Your organization is implementing a new security policy to control how firewall rules are applied to control flows between virtual machines (VMs). Using Google-recommended practices, you need to set up a firewall rule to enforce strict control of traffic between VM A and VM B. You must ensure that communications flow only from VM A to VM B within the VPC, and no other communication paths are allowed. No other firewall rules exist in the VPC. Which firewall rule should you configure to allow only this communication path?

   • AFirewall rule direction: ingress Action: allow - Target: VM B service account - Source ranges: VM A service account Priority: 1000
   • BFirewall rule direction: ingress Action: allow - Target: specific VM B tag - Source ranges: VM A tag and VM A source IP address Priority: 1000
   • CFirewall rule direction: ingress Action: allow - Target: VM A service account - Source ranges: VM B service account and VM B source IP address Priority: 100
   • DFirewall rule direction: ingress Action: allow - Target: specific VM A tag - Source ranges: VM B tag and VM B source IP address Priority: 100

   Show answer

   Answer: A

   Explanation

   changing to A. If we follow what the documentation say's, A is the correct: "If you need strict control over how firewall rules are applied to VMs, use target service accounts and source service accounts instead of target tags and source tags" https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags

   Source: Adapted from community discussion — pfilourenco

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 49 · 255 in bank

   You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision. What should you do?

   • AUse the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.
   • BUse Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.
   • CConfigure VPC Flow Logs. Review the logs by filtering on the source and destination.
   • DConfigure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 50 · 255 in bank

    You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6 virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest-possible latency while ensuring high availability and autoscaling, and create native content-based rules using the HTTP hostname and request path. The IP addresses of the clients that connect to the load balancer need to be visible to the backends. Which configuration should you use?

    • AUse Network Load Balancing
    • BUse TCP Proxy Load Balancing with PROXY protocol enabled
    • CUse External HTTP(S) Load Balancing with URL Maps and custom headers
    • DUse External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header

    Show answer

    Answer: D

    Explanation

    A. Use Network Load Balancing - for TCP, UDP B. Use TCP Proxy Load Balancing with PROXY protocol enabled - internal or externtal? for TCP, UDP C. Use External HTTP(S) Load Balancing with URL Maps and custom headers (Possibly, but need client IP) D. Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header - right

    Source: Adapted from community discussion — nosense

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 41. 255 questions available.