Google Professional-Cloud-Network-Engineer Exam Real Questions

Prepare and pass your Professional Cloud Network Engineer with free Professional-Cloud-Network-Engineer exam questions.

Page: 1 / 36

Total 180 Questions | Updated On: Oct 09, 2024

Add To Cart

Question 1

You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?

A : able Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.

B : able VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.

C : able VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.

D : able Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field

Answer: B

Question 2

Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?

A : eate a VPC firewall rule in each VPC to block traffic from any source, with priority 0.

B : eate a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.

C : eate two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.

D : eate two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.

Answer: B

Question 3

You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In

one of your instances you notice the master is not responding, even though the cluster is up and running.

What should you do to solve the problem?

A : ign a public IP address to the instance.

B : eate a route to reach the Master, pointing to the default internet gateway.

C : eate the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.

D : eate the appropriate master authorized network entries to allow the instance to communicate to the master.

Answer: D

Question 4

You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size

is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new

services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services.

You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.

How should you design this topology?

A : eate a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.

B : eate a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.

C : gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.

D : gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.

Answer: A

Question 5

You are using a single Cloud Router to exchange routes between your VPC and on-premises network with Dedicated Interconnect. You want to make sure you can still forward traffic, even if all the Cloud Routers in a region go down. What should you do?

A : eate a second Cloud Router in the same region, but with a Border Gateway Protocol (BGP) session to a second on-premises device.

B : rn on graceful restart on your on-premises router.

C : rn on global routing in your VPC, and create another Cloud Router in a different region.

D : static routes as a backup to Cloud Router.

Answer: C

Page: 1 / 36

Total 180 Questions | Updated On: Oct 09, 2024

Add To Cart