Professional-Cloud-Network-Engineer Questions Prepare with Learning Information! 2025 Regularly updated
Get Professional-Cloud-Network-Engineer Products Practice Material for Professional-Cloud-Network-Engineer Exam Question Preparation
Google Professional-Cloud-Network-Engineer certification exam is a rigorous and comprehensive assessment of a candidate's skills and knowledge in designing and implementing network solutions on the Google Cloud Platform. Professional-Cloud-Network-Engineer exam consists of multiple-choice questions and performance-based tasks that require candidates to demonstrate their ability to design, implement, and manage network solutions on the Google Cloud Platform.
Google Professional-Cloud-Network-Engineer certification is an essential credential for professionals who work with Google Cloud network solutions. It demonstrates their proficiency in designing, implementing and managing network solutions on the Google Cloud platform. Google Cloud Certified - Professional Cloud Network Engineer certification is particularly beneficial for network engineers, network architects, and cloud architects who want to advance their careers in cloud networking.
NEW QUESTION # 77
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices.
How should you design this topology?
- A. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
- B. Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- C. Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- D. Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION # 78
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-pathto a specific URL used for health checking, and set proxy-headerto PROXY_V1.
- B. Set proxy-header to the default value, and set hostto include a custom host header that identifies the health check.
- C. Set request-path to a specific URL used for health checking, and set hostto include a custom host header that identifies the health check.
- D. Set request-path to a specific URL used for health checking, and set responseto a string that the backend service will always return in the response body.
Answer: C
Explanation:
https://cloud.google.com/load-balancing/docs/health-checks
NEW QUESTION # 79
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the compute.instanceAdminto your user account.
- B. Grant the cloud-platformprivilege to the service account for the Cloud Storage bucket.
- C. Grant the iam.serviceAccountUserto your user account.
- D. Grant the read-onlyprivilege to the service account for the Cloud Storage bucket.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/access/iam
NEW QUESTION # 80
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- B. Generate a new SSH key pair. Verify the format of the public key and add it to the project.
SSH into the instance using a third-party tool like putty or ssh. - C. Generate a new SSH key pair. Verify the format of the private key and add it to the instance.
SSH into the instance using a third-party tool like putty or ssh. - D. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
Answer: D
Explanation:
https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION # 81
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?
- A. You do not have a load balancer to load-balance the network traffic.
- B. One of the VPN sessions is configured incorrectly.
- C. BGP sessions are not established between both on-premises routers and the Cloud Router.
- D. A firewall is blocking the traffic across the second VPN connection.
Answer: A
NEW QUESTION # 82
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?
- A. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
- B. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
- C. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
- D. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
Answer: C
Explanation:
VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.
Reference: https://cloud.google.com/vpc/docs/vpc-peering
NEW QUESTION # 83
The security team has disabled external SSH access into production virtual machines in GCP.
The operations team needs to remotely manage the VMs and other resources. What can they do?
- A. Develop a new access request process that grants temporary SSH access to cloud VMs when an operations engineer needs to perform a task.
- B. Have the development team build an API service that allows the operations team to execute specific remote procedure calls to accomplish their tasks.
- C. Configure a VPN connection to GCP to allow SSH access to the cloud VMs.
- D. Grant the operations team access to use Google Cloud Shell.
Answer: D
Explanation:
Grant the operations team access to use Google Cloud Shell.
B (Correct Answer) - Grant the operations engineers access to use Google Cloud Shell.
All the engineer asked is remote access the VMs just like using SSH, so if the machines still have an external IP address, the engineers can access them via SSH using Google Cloud Shell.
This is easies effective way to meet the requirements. All other answers are possible options that might require more setup than worthwhile for your needs.
NEW QUESTION # 84
You have configured Cloud CDN using HTTP(S) load balancing as the origin for cacheable content. Compression is configured on the web servers, but responses served by Cloud CDN are not compressed.
What is the most likely cause of the problem?
- A. You have configured the web servers and Cloud CDN with different compression types.
- B. You have to configure the web servers to compress responses even if the request has a Via header.
- C. The web servers behind the load balancer are configured with different compression types.
- D. You have not configured compression in Cloud CDN.
Answer: B
Explanation:
If responses served by Cloud CDN are not compressed but should be, check that the web server software running on your instances is configured to compress responses. By default, some web server software will automatically disable compression for requests that include a Via header. The presence of a Via header indicates the request was forwarded by a proxy. HTTP proxies such as HTTP(S) load balancing add a Via header to each request as required by the HTTP specification.
To enable compression, you may have to override your web server's default configuration to tell it to compress responses even if the request had a Via header.
https://cloud.google.com/cdn/docs/troubleshooting-steps
NEW QUESTION # 85
You want to configure a NAT to perform address translation between your on-premises network blocks and GCP.
Which NAT solution should you use?
- A. An instance configured with iptables SNAT rules
- B. An instance with IP forwarding enabled
- C. An instance configured with iptables DNAT rules
- D. Cloud NAT
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/nat/docs/overview
NEW QUESTION # 86
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- B. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- C. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
- D. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
Answer: C
Explanation:
https://cloud.google.com/sdk/gcloud/reference/dns/record-sets/import
NEW QUESTION # 87
You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner.
What should you first?
- A. Ask your Interconnect partner to provision a physical connection to Google.
- B. Log in to your partner's portal and request the VLAN attachment there.
- C. Run gcloud compute interconnect attachments partner update <attachment> / -- region <region> --admin-enabled.
- D. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
Answer: A
Explanation:
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview?hl=En#provisioning "To provision a Partner Interconnect connection with a service provider, you start by connecting your on-premises network to a supported service provider. Work with the service provider to establish connectivity.
NEW QUESTION # 88
You need to give each member of your network operations team least-privilege access to create, modify, and delete Cloud Interconnect VLAN attachments.
What should you do?
- A. Give each user the following permissions only: compute.interconnectAttachments.create, compute.
interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update. - B. Assign each user the editor role.
- C. Assign each user the compute.networkAdmin role.
- D. Give each user the following permissions only: compute.interconnectAttachments.create, compute.
interconnectAttachments.get.
Answer: A
Explanation:
https://cloud.google.com/interconnect/docs/how-to/dedicated/creating-vlan-attachments
NEW QUESTION # 89
You need to configure a Google Kubernetes Engine (GKE) cluster. The initial deployment should have 5 nodes with the potential to scale to 10 nodes. The maximum number of Pods per node is 8. The number of services could grow from 100 to up to 1024. How should you design the IP schema to optimally meet this requirement?
- A. Configure a /28 primary IP address range for the node IP addresses. Configure a /25 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
- B. Configure a /28 primary IP address range for the node IP addresses. Configure a /28 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
- C. Configure a /28 primary IP address range for the node IP addresses. Configure a (25 secondary IP range for the Pods. Configure a /22 secondary IP range for the Services.
- D. Configure a /28 primary IP address range for the node IP addresses. Configure a /24 secondary IP range for the Pads. Configure a /22 secondary IP range for the Services.
Answer: C
NEW QUESTION # 90
You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
- A. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168 20.88.
Configure your on-premises firewall to accept traffic from 35.199.192.0/19 Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. - B. Create a private zone in Cloud DNS for 'corp altostrat.com' called corp-altostrat-com.
Configure DNS Server Policies and create a policy with Alternate DNS servers to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 35.199.192.0/19. - C. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
Set a custom route advertisement on the Cloud Router for 10.204.0.0/24 - D. Create a private forwarding zone in Cloud DNS for 'corp .altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
Modify the /etc/resolv conf file on your Compute Engine instances to point to 192.168.20 88
Answer: B
Explanation:
Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
NEW QUESTION # 91
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
- B. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
- C. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
- D. Manually patch some of the instances, and then perform a rolling restart on the instance group.
Answer: A
NEW QUESTION # 92
Your company has launched a mobile application that uploads pictures to google cloud storage bucket. The application was successfully uploading the pictures to google cloud storage buckets, but lately the application has become popular and you start seeing 429 errors. Please suggest the ways to address the issue. Please select any two.
- A. Use truncated exponential backoff
- B. The OAuth access token has expired and needs to be refreshed.
- C. Use the correct verb with the /upload or /download URLs.
- D. Throttle your client's requests
Answer: A
Explanation:
Option A and Option B are the Correct choices because , a 429 error is caused by Too Many Requests.If your application tries to use more than its limit, additional requests will fail. Throttle your client's requests, and/or use truncated exponential backoff.
Option C is Incorrect choice because, a OAuth access token has expiry would result in error
401(Unauthorized)
Option D is Incorrect because, using wrong verb with /upload or /download URLs would lead to
405 (method not allowed error).
NEW QUESTION # 93
Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it is a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost.
Which two steps should you take? (Choose two.)
- A. SSH into the backend compute engine instances, and view the auth logs and syslogs to further understand the nature of the attack.
- B. Increase the maximum autoscaling backend to accommodate the severe bursty traffic.
- C. Use Cloud Armor to blacklist the attacker's IP addresses.
- D. Shut down the entire application in GCP for a few hours. The attack will stop when the application is offline.
- E. Create a global HTTP(s) load balancer and move your application backend to this load balancer.
Answer: A,B
NEW QUESTION # 94
You are troubleshooting an application in your organization's Google Cloud network that is not functioning as expected. You suspect that packets are getting lost somewhere. The application sends packets intermittently at a low volume from a Compute Engine VM to a destination on your on-premises network through a pair of Cloud Interconnect VLAN attachments. You validated that the Cloud Next Generation Firewall (Cloud NGFW) rules do not have any deny statements blocking egress traffic, and you do not have any explicit allow rules. Following Google-recommended practices, you need to analyze the flow to see if packets are being sent correctly out of the VM to isolate the issue. What should you do?
- A. Enable VPC Flow Logs on the subnet that the VM is deployed in with sample_rate = 1.0, and run a query in Logs Explorer to analyze the packet flow.
- B. Create a packet mirroring policy that is configured with your VM as the source and destined to a collector. Analyze the packet captures.
- C. Verify the network/attachment/egress_dropped_packet.s_count Cloud Interconnect VLAN attachment metric.
- D. Enable Firewall Rules Logging on your firewall rules and review the logs.
Answer: A
Explanation:
Explanation: Enabling VPC Flow Logs with sample_rate = 1.0 on the VM's subnet will give detailed information about network traffic flowing to and from your VM. You can then query this data in Logs Explorer to check whether packets are leaving the VM and reaching the intended destination. This is a recommended practice for troubleshooting such network issues.
: Google VPC Flow Logs Documentation
NEW QUESTION # 95
You are designing a packet mirroring policy as pan of your network security architecture for your gaming workload. Your Infrastructure is located in the us-west2 region and deployed across several zones: us-west2- a. us-west2-b. and us-west2-c The Infrastructure Is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monitor web application traffic while minimizing inter-zonal network egress costs.
Following Google-recommended practices, how should you deploy the packet mirroring policies and collector instances?
- A. Create three packet mirroring policies: one for each zone. Create three groups of collector instances:
one group for each zone. Configure each policy to match traffic for Its zone based on instance-tags, and create a filter for TCP traffic. - B. Create one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region Configure the packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.
- C. Create three packet mirroring policies: one for each zone. Create three groups of collector instances:
one group for each zone. Configure
each policy to match traffic for its zone based on subnets, and create a filter for TCP traffic - D. Create three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic
Answer: D
Explanation:
* Create Packet Mirroring Policies:
* You need to create three packet mirroring policies, one for each zone (us-west2-a, us-west2-b, and us-west2-c). This ensures that each zone's traffic is mirrored appropriately without unnecessary cross-zone traffic.
* Create Collector Instances:
* Set up one group of collector instances for the us-west2 region. Having a single group of collector instances for the entire region minimizes the number of instances required and simplifies the management while keeping egress costs low since the collectors are within the same region.
* Configuration of Policies:
* Each packet mirroring policy should be configured to match traffic for its specific zone. Use instance-tags to identify and match the relevant instances within each zone. This helps in correctly capturing the traffic from the appropriate sources.
* Filter for TCP Traffic:
* Create a filter for TCP traffic (ports 80 and 443). This step ensures that only the relevant web application traffic is mirrored, reducing the amount of data processed and improving efficiency.
* Cost Efficiency:
* By having packet mirroring policies specific to each zone and a regional collector group, you reduce inter-zonal network egress costs. The data remains within the same region, avoiding extra charges associated with cross-zone traffic.
NEW QUESTION # 96
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. Network load balancer
- B. SSL proxy load balancer
- C. TCP proxy load balancer
- D. HTTPS load balancer
Answer: C
Explanation:
https://cloud.google.com/security/encryption-in-transit/ Automatic encryption between GFEs and backends For the following load balancer types, Google automatically encrypts traffic between Google Front Ends (GFEs) and your backends that reside within Google Cloud VPC networks: HTTP(S) Load Balancing TCP Proxy Load Balancing SSL Proxy Load Balancing
NEW QUESTION # 97
Your company's Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead.
They are currently using the following directory structure:
/fr/video
/en/video
/es/video
/../video
/fr/audio
/en/audio
/es/audio
/../audio
Which solution should you recommend?
- A. Leave the directory structure as-is, create a URL map and leverage a path rule such as \/[a-z]{2}\/video and
\/[a-z]{2}\/audio. - B. Leave the directory structure as-is, create a URL map and leverage a path rule such as /*/video and /*/ audio.
- C. Rearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio
/*. - D. Rearrange the directory structure, create DNS hostname entries for video and audio and leverage a path rule such as /video/* and /audio/*.
Answer: C
Explanation:
https://cloud.google.com/load-balancing/docs/url-map#configuring_url_maps Path matcher constraints Path matchers and path rules have the following constraints: A path rule can only include a wildcard character (*) after a forward slash character (/). For example, /videos/* and /videos/hd/* are valid for path rules, but /videos* and /videos/hd* are not. Path rules do not use regular expression or substring matching. For example, path rules for either /videos/hd or /videos/hd/* do not apply to a URL with the path /video/hd-abcd. However, a path rule for /video/* does apply to that path. https://cloud.google.com
/load-balancing/docs/url-map-concepts#pm-constraints
NEW QUESTION # 98
......
Most Reliable Google Professional-Cloud-Network-Engineer Training Materials: https://www.prepawayexam.com/Google/braindumps.Professional-Cloud-Network-Engineer.ete.file.html
The Realest Study Materials Professional-Cloud-Network-Engineer Dumps: https://drive.google.com/open?id=1HLOt1JOFsrw9LpdLjXLd7Z9CyOixwjMw