PCNE practice questions 61–70

1. Question 61 · 255 in bank

   Your company's logo is published as an image file across multiple websites that are hosted by your company. You have implemented Cloud CDN; however, you want to improve the performance of the cache hit ratio associated with this image file. What should you do?

   • AConfigure custom cache keys for the backend service that holds the image file, and clear the Host and Protocol checkboxes.
   • BConfigure the default time to live (TTL) as 0 for the image file.
   • CConfigure versioned URLs for each domain to serve users the image file before the cache entry expires.
   • DConfigure Cloud Storage as a custom origin backend to host the image file, and select multi-region as the location type.

   Show answer

   Answer: A

   Explanation

   For performance and scalability, it's important to optimize the cache hit ratio. By default, Cloud CDN uses the complete request URL to build the cache key. To help optimize your cache hit ratio, you can use custom cache keys so that Cloud CDN doesn't unnecessarily shard the cache. https://cloud.google.com/cdn/docs/best-practices#cache-hit-ratio Answer is A

   Source: Adapted from community discussion — desertlotus1211

   References

   • Google Cloud documentation

   Next question

2. Question 62 · 255 in bank

   Your company recently migrated to Google Cloud in a single region. You configured separate Virtual Private Cloud (VPC) networks for two departments: Department A and Department B. Department A has requested access to resources that are part of Department B's VPC. You need to configure the traffic from private IP addresses to flow between the VPCs using multi-NIC virtual machines (VMs) to meet security requirements. Your configuration also must: • Support both TCP and UDP protocols • Provide fully automated failover • Include health-checks • Require minimal manual intervention in the client VMs Which approach should you take?

   • ACreate the VMs in the same zone, and configure static routes with IP addresses as next hops.
   • BCreate the VMs in different zones, and configure static routes with instance names as next hops.
   • CCreate an instance template and a managed instance group. Configure a single internal load balancer, and define a custom static route with the internal TCP/UDP load balancer as the next hop.
   • DCreate an instance template and a managed instance group. Configure two separate internal TCP/UDP load balancers for each protocol (TCP/UDP), and configure the client VMs to use the internal load balancers’ virtual IP addresses.

   Show answer

   Answer: C

   Explanation

   This approach meets all the requirements: • Support both TCP and UDP protocols: Internal load balancers support both TCP and UDP protocols. • Provide fully automated failover: Managed instance groups provide fully automated failover. If one of the VMs in the instance group fails, the traffic will be automatically routed to another VM in the group. • Include health-checks: Internal load balancers include health-checks. The load balancer will automatically check the health of the VMs in the instance group and remove any unhealthy VMs from the pool. • Require minimal manual intervention in the client VMs: Once the custom static route is configured, the client VMs will automatically route traffic to the internal load balancer. No manual intervention is required in the client VMs.

   Source: Adapted from community discussion — thewalker

   Next question

3. Question 63 · 255 in bank

   You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space in your enterprise, you plan to use privately used public IP space for the new clusters. You want to follow Google-recommended practices. What should you do after designing your IP scheme?

   • ACreate the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters.
   • BCreate the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters, Re-use the secondary address range for the services across multiple private GKE clusters.
   • CCreate privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --enable-ip-alias and --enable-private-nodes.
   • DCreate privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --disable-default-snat, --enable-ip-alias, and --enable-private-nodes.

   Show answer

   Answer: D

   References

   • Google Cloud documentation

   Next question

4. Question 64 · 255 in bank

   You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket. You are using the USE_ORIGIN_HEADERS cache mode. You receive an HTTP 403 error when opening the file in your browser, and you see that the HTTP response has a Cache-Control: private, max-age=0 header. How should you correct this issue?

   • AEnable negative caching for the backend bucket.
   • BChange the cache mode to Force cache all content. C Configure a Cloud Storage bucket permission that gives allUsers the Storage Legacy Object Reader role.
   • CIncrease the default time-to-live (TTL) for the backend service.

   Show answer

   Answer: B

   Explanation

   I go for C, 403 means forbidden, need authorization. Why can't I select the option C? By the way negative caching is used for other error codes: https://cloud.google.com/cdn/docs/using-negative-caching

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation

   Next question

5. Question 65 · 255 in bank

   You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer. You must ensure that your application meets the following requirements: • Maps multiple existing reserved external IP addresses to the instance • Processes IP Encapsulating Security Payload (ESP) traffic What should you do?

   • AConfigure a target pool, and create protocol forwarding rules for each external IP address.
   • BConfigure a backend service, and create an external network load balancer for each external IP address.
   • CConfigure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
   • DConfigure the Compute Engine instances’ network interface external IP address from None to Ephemeral. Add as many external IP addresses as required.

   Show answer

   Answer: C

   Explanation

   Protocol forwarding uses a regional forwarding rule to deliver packets of a specific protocol to a single virtual machine (VM) instance. The forwarding rule can have an internal or an external IP address. Protocol forwarding delivers packets while preserving the destination IP address of the forwarding rule. The forwarding rule references an object called a target instance, which, in turn, references a single VM instance https://cloud.google.com/load-balancing/docs/protocol-forwarding#target-instances

   Source: Adapted from community discussion — ExamQnA

   References

   • Google Cloud documentation

   Next question

6. Question 66 · 255 in bank

   Your product team has web servers running on both us-east1 and us-west1 regions in the prod-servers project. Your security team plans to install an intrusion detection system (IDS) in their own Google Cloud project to inspect the incoming network traffic. What should you do?

   • ACreate a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Create an internal load balancer and the IDS system in both us-east1 and us-west1. Enable Packet Mirroring, and create packet mirroring policies inside the new project.
   • BCreate a host project and a Sharad VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Enable IP forwarding on all the web servers. Create the IDS system in a non-shared subnet of us-east1 or us-west1. Configure the web servers to forward the packets to the IDS system. C. Create a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Enable IP forwarding on all the web servers. Install the IDS system in both us-east1 and us-west1. Configure the web servers to forward the packets to the IDS system.
   • CCreate a host project and a Shared VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Create an internal load balancer and the IDS system in a subnet in either us-east1 or us-west1. Enable Packet Mirroring, and create a packet mirroring policy inside the host project.

   Show answer

   Answer: A

   References

   • Google Cloud documentation

   Next question

7. Question 67 · 255 in bank

   Select 2

   You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection. Which two actions can accomplish this? (Choose two.)

   • AOpen a Cloud Support ticket under the Cloud Interconnect category.
   • BDownload the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
   • CRun gcloud compute interconnects describe <interconnect>.
   • DCheck the email for the account of the NOC contact that you specified during the ordering process.
   • EContact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.

   Show answer

   Answer: BD

   Explanation

   Correct is B and D. After you order an interconnect, Google sends you and the NOC (technical contact) an email with your LOA-CFAs (one PDF file per interconnect). You must send these LOA-CFAs to your vendor so that they can install your cross connects. If you don't, your interconnects won't get connected. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/dedicated/retrieving-loas

   Source: Adapted from community discussion — superpane

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 68 · 255 in bank

   Select 2

   You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) instances. What two prerequisite tasks must be completed before creating the load balancer? (Choose two.)

   • AChoose a region.
   • BCreate firewall rules for health checks.
   • CReserve a static IP address for the load balancer.
   • DDetermine the subnet mask for a proxy-only subnet.
   • EDetermine the subnet mask for Serverless VPC Access.

   Show answer

   Answer: BD

   Explanation

   A) No: The region must match that of your application instances, so there is no choice to be made. B) Yes: FW rules are needed for the healthchecks (and also for the proxies) C) No: Reserving a static IP for the LB is an optional step, not a prerequisite D) Yes: A proxy-only subnet reservation is necessary for the Internal HTTP Load Balancer E) No: Serverless VPC Access is not relevant to this question https://cloud.google.com/load-balancing/docs/l7-internal/setting-up-l7-internal#configure-a-network

   Source: Adapted from community discussion — BenMS

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 69 · 255 in bank

   Your team is developing an application that will be used by consumers all over the world. Currently, the application sits behind a global external application load balancer. You need to protect the application from potential application-level attacks. What should you do?

   • AEnable Cloud CDN on the backend service.
   • BCreate multiple firewall deny rules to block malicious users, and apply them to the global external application load balancer.
   • CCreate a Google Cloud Armor security policy with web application firewall rules, and apply the security policy to the backend service
   • DCreate a VPC Service Controls perimeter with the global external application load balancer as the protected service, and apply it to the backend service.

   Show answer

   Answer: C

   Explanation

   Google Cloud Armor is a fully managed web application firewall (WAF) service that protects your applications from common web attacks. It can be applied to various Google Cloud resources, including global external application load balancers. By creating a Google Cloud Armor security policy with WAF rules, you can effectively protect your application from potential application-level attacks such as SQL injection, cross-site scripting (XSS), and denial-of-service (DoS) attacks. These rules analyze incoming traffic and block malicious requests before they reach your backend service, safeguarding your application and its users.

   Source: Adapted from community discussion — Mithung30

   Next question

10. Question 70 · 255 in bank

    Select 2

    You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Iga1 and int-Iga2) terminate on the same Cloud Router. The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. If the active Interconnect connection falls, you want the passive Interconnect connection to automatically begin routing all traffic. Which two actions should you take to meet this requirement? (Choose two.)

    

    • AConfigure the advertised route priority as 200 for the BGP session associated with the active interconnect connection.
    • BConfigure the advertised route priority > 10,200 on the active Interconnect connection.
    • CAdvertise a lower MED on the active Interconnect connection from the on-premises router.
    • DAdvertise a lower MED on the passive Interconnect connection from the on-premises router.
    • EConfigure the advertised route priority as 200 for the BGP session associated with the passive Interconnect connection.

    Show answer

    Answer: CE

    Explanation

    The base priority is 100. there is no region to region cost. So you want to set the base priority of the passive interconnect to 200 and keep the active one default of 100. the MED will be 100 for active and 200 for passive. A&E are the answers https://cloud.google.com/network-connectivity/docs/router/concepts/overview

    Source: Adapted from community discussion — desertlotus1211

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 61. 255 questions available.