RealExamFree Professional-Cloud-Network-Engineer Dumps Real Exam Questions Test Engine Dumps Training
Google Professional-Cloud-Network-Engineer exam dumps and online Test Engine
Introduction to Google Professional Cloud Network Engineer Exam
Google Professional Cloud Network Engineer Exam is a certification exam that is conducted by Google to validates candidate knowledge and skills of working as a Professional Cloud network engineer in the IT industry.
After passing this exam, candidates get a certificate from Google that helps them to demonstrate their proficiency in Google Professional Cloud Network Engineer to their clients and employers.
Implement GCP VPCs
- Configure VPCs: This subject area requires that the candidates have the ability to configure GCP virtual private Cloud resources; configure VPC peering; create shared VPCs and explain the process of sharing subnets with the other projects;
- Configure & Maintain Google Kubernetes Engine Clusters: This subsection covers the skills in using private clusters, clustered with the shared VPC, VPC-native clustered with the use of alias IPs and including authorized networks for cluster master access;
- Configure & Manage Firewall Rules: This part will measure one’s knowledge of priority, firewall logs, ingress & egress rules, network protocols, and target service accounts & network tags.
Preparation Materials for Google Professional Cloud Network Engineer
If you are determined to pass the Google Professional Cloud Network Engineer exam from the first attempt, all you have to do is explore the training resources available online. So, you can use the materials provided by Google as well as use the study guides that you can buy from Amazon. Here are some viable and efficient examples:
- Google Network Engineer Learning Path
With the help of Google learning materials, you can enhance your skills in implementing different network solutions that will improve your organization’s performance. This learning path includes both courses and skill badges. Thus, the candidates will need to go through the following steps to consolidate their knowledge:
- The first course is dedicated to learning the Google Cloud Fundamentals and focuses on Core Infrastructure. While attending this training, the exam-takers will learn how to use and manage storage and computing services with the help of the Google Cloud Platform. They will learn how to use different tools such as Cloud SQL, Google Kubernetes Engine, or BigQuery.
- The second step in this learning path is a skill badge that focuses on the creation and management of Cloud Resources. It’s not necessary for the exam-takers to have much experience in the cloud as in this part, they will get exposed to different projects that use the Google Cloud platform. For example, they will learn how to manage the Cloud Shell commands as well as deploy a virtual machine.
- The third part would be to also get the skill badge for performing tasks related to developing functional infrastructure in the Google Cloud Platform. The test-takers will learn how to use Cloud Storage features and services for improving the business performance. For instance, they will learn how to manage Stackdriver or different Cloud Functions that will make any Google Cloud project successful.
- The following phase included in the Cloud Network Engineer learning path is taking the course dedicated to networking in Google Cloud. Within this course, the candidates will learn how to scale and manage their organization using Google Cloud features. Also, they will learn about the VPC networks, firewalls, and establishing interconnections among load balancing or networks.
- The final skill badge that the applicants will earn is related to building and securing networks by using Google Cloud. With this endorsement, they will learn the essential services and tools used in Google Cloud networking processes. Besides, applicants will have the opportunity to gain more practical knowledge that will help them build reliable networks.
By following this learning track, which also includes 20 labs, you will consolidate your skills on the domains tested in the Google Professional Cloud Network Engineer exam and increase your chances to get the passing score from the first attempt.
- Google Cloud – Professional Cloud Network Engineer: Exam Practice & Review Questions for Google Cloud – Professional Cloud Network Engineer Exam Prep (Latest Version)
This book will help you constantly check your preparedness level and understand how the real exam is structured. It is available on Amazon, in Kindle format, and has been published by Ace It. The specialists who want to get certified can fetch it if they pay around $6-$7. As the difficulty of the final test and the competition are quite high, the exam questions included in this book will help you consolidate your knowledge on all the tested topics. Also, the book has been updated in 2020 so that it follows the test's latest blueprint.
NEW QUESTION 48
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
- B. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- C. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- D. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
Answer: A
Explanation:
https://cloud.google.com/sdk/gcloud/reference/dns/record-sets/import
NEW QUESTION 49
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices.
How should you design this topology?
- A. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
- B. Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- C. Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- D. Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 50
You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours.
Which connectivity method should you choose?
- A. Dedicated Interconnect, but don't provision any VLAN attachments
- B. Dedicated Interconnect with a single VLAN attachment
- C. Cloud VPN
- D. 50-Mbps Partner VLAN attachment
Answer: C
NEW QUESTION 51
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?
- A. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag.
- B. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.
- C. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.
- D. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A.
Answer: C
NEW QUESTION 52
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)
- A. Enable Private Google Access on all the subnets.
- B. Enable Private Google Access on the VPC.
- C. Enable Private Services Access on the VPC.
- D. Create network peering between your VPC and BigQuery.
- E. Create a Cloud NAT, and route the application traffic via NAT gateway.
Answer: B,E
NEW QUESTION 53
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Disable DNSSEC at your domain registar.
- B. Update the TTL for the zone.
- C. Transfer ownership of the domain to a new registar.
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone. - D. Set the zone to the TRANSFER state.
Answer: A
NEW QUESTION 54
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* BGP sessions are established between both on-premises routers and the Cloud Router.
* Only 1 of the on-premises router's routes are being added to the routing table.
What is the most likely cause of this problem?
- A. A firewall is blocking the traffic across the second VPN connection.
- B. The on-premises routers are configured with the same routes.
- C. The ASNs being used on the on-premises routers are different.
- D. You do not have a load balancer to load-balance the network traffic.
Answer: C
Explanation:
https://cloud.google.com/network-connectivity/docs/router/support/troubleshooting#ecmp
NEW QUESTION 55
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?
- A. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
- B. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
- C. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
- D. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
Answer: C
Explanation:
VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.
NEW QUESTION 56
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A. Assign members of the networking team the compute.networkAdmin role.
- B. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.
- C. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
- D. Assign members of the networking team the compute.networkUser role.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/access/iam
NEW QUESTION 57
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost.
Which two steps should you take? (Choose two.)
- A. Enable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-dev) a service project.
- B. Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
- C. Connect the VPCs in project code-dev and data-dev using VPC Network Peering.
- D. Connect both projects using Cloud VPN.
- E. Create a route in the code-dev project to the destination prefixes in project data-dev and use nexthop as the default gateway, and vice versa.
Answer: B,C
NEW QUESTION 58
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
- A. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
- B. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
- C. Rename the default VPC as "Distribution" and peer it via network peering.
- D. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/using-vpc
NEW QUESTION 59
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
- B. Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
- C. Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.
- D. Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
Answer: A
Explanation:
https://cloud.google.com/load-balancing/docs/health-check-concepts#content-based_health_checks
NEW QUESTION 60
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?
- A. Delete the legacy network and recreate it to allow transitive peering.
- B. Configure VPC peering in a full mesh.
- C. Alter the routing table to resolve the asymmetric route.
- D. Create network tags to allow connectivity between all three VPCs.
Answer: B
NEW QUESTION 61
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. TCP proxy load balancer
- B. Network load balancer
- C. SSL proxy load balancer
- D. HTTPS load balancer
Answer: C
Explanation:
https://cloud.google.com/security/encryption-in-transit/
NEW QUESTION 62
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection.
Which two actions can accomplish this? (Choose two.)
- A. Open a Cloud Support ticket under the Cloud Interconnect category.
- B. Check the email for the account of the NOC contact that you specified during the ordering process.
- C. Run gcloud compute interconnects describe <interconnect>.
- D. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
- E. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.
Answer: B,D
NEW QUESTION 63
You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even though the cluster is up and running.
What should you do to solve the problem?
- A. Assign a public IP address to the instance.
- B. Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.
- C. Create a route to reach the Master, pointing to the default internet gateway.
- D. Create the appropriate master authorized network entries to allow the instance to communicate to the master.
Answer: D
Explanation:
https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#cant_reach_cluster
https://cloud.google.com/kubernetes-engine/docs/how-to/authorized-networks
NEW QUESTION 64
You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload.
Which type of load balancer should you use?
- A. TCP/SSL proxy load balancer
- B. Network load balancer
- C. HTTP(S) load balancer
- D. Internal load balancer
Answer: B
Explanation:
Reference:
https://cloud.google.com/load-balancing/docs/network
NEW QUESTION 65
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
- A. setIamPolicy() via REST API
- B. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
- C. gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
- D. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
- E. GetIamPolicy() via REST API
Answer: C,D
NEW QUESTION 66
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
- Each on-premises router is configured with a unique ASN. ?Each on-
premises router is configured with the same routes and priorities.
- Both on-premises routers are configured with a VPN connected to a
single Cloud Router.
- BGP sessions are established between both on-premises routers and the Cloud Router.
- Only 1 of the on-premises router's routes are being added to the
routing table.
What is the most likely cause of this problem?
- A. A firewall is blocking the traffic across the second VPN connection.
- B. The on-premises routers are configured with the same routes.
- C. You do not have a load balancer to load-balance the network traffic.
- D. The ASNs being used on the on-premises routers are different.
Answer: C
NEW QUESTION 67
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
- B. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
- C. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.* Configure the appropriate static routes.
- D. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel per subnet.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Create the appropriate static routes.
Answer: C
NEW QUESTION 68
You need to give each member of your network operations team least-privilege access to create, modify, and delete Cloud Interconnect VLAN attachments.
What should you do?
- A. Assign each user the editor role.
- B. Assign each user the compute.networkAdmin role.
- C. Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get.
- D. Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update.
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION 69
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
Which BGP attribute should you use on your on-premises router?
- A. Multi-exit Discriminator
- B. AS-Path
- C. Local Preference
- D. Community
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/router/docs/concepts/overview
NEW QUESTION 70
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
- B. Grant the read-only privilege to the service account for the Cloud Storage bucket.
- C. Grant the compute.instanceAdmin to your user account.
- D. Grant the iam.serviceAccountUser to your user account.
Answer: D
Explanation:
https://cloud.google.com/compute/docs/access/iam
NEW QUESTION 71
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. TCP proxy load balancer
- B. Network load balancer
- C. SSL proxy load balancer
- D. HTTPS load balancer
Answer: C
NEW QUESTION 72
......
Google Professional-Cloud-Network-Engineer: Selling Google Cloud Platform Products and Solutions: https://www.realexamfree.com/Professional-Cloud-Network-Engineer-real-exam-dumps.html
Reliable Professional-Cloud-Network-Engineer Exam Tips Test Pdf Exam Material: https://drive.google.com/open?id=1BJSag4qOMn7snP3Ex5hTfeDLe6pXWAwu
