Google Cloud Certified - Professional Cloud Network Engineer - Professional-Cloud-Network-Engineer Exam Questions

QUESTION NO: 1
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)

QUESTION NO: 2
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer.
You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service.
What should you do?

QUESTION NO: 3
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?

QUESTION NO: 4
You are designing the networking for a Google Kubernetes Engine (GKE) cluster that will host an internal, employee-facing application. This application needs to be accessible from your on- premises corporate network and from specific internal VPC networks in Google Cloud. You need to design a highly available and scalable load balancing solution for ingress traffic with a cookie- based session affinity without exposing the application to the public internet. What should you do?

QUESTION NO: 5
You are configuring a new instance of Cloud Router in your Organization's Google Cloud environment to allow connection across a new Dedicated Interconnect to your data center Sales, Marketing, and IT each have a service project attached to the Organization's host project.
Where should you create the Cloud Router instance?

QUESTION NO: 6
Your company runs its applications on Google Kubernetes Engine (GKE), and your team recently created a private Cloud DNS zone, corp.internal, to host records for internal services, such as a managed database at db.corp.internal. You verified that a Compute Engine VM in the same VPC as your GKE cluster can successfully resolve db.corp.internal. However, when you access a Pod inside your GKE cluster, you can resolve in-cluster services (for example, kubernetes.default.svc.cluster.local), but any attempt to resolve db.corp.internal fails.
Upon inspecting the coredns ConfigMap in the kube-system namespace, you discovered the default forward plugin has been modified to point directly to a public DNS provider's IP address, bypassing the node's local resolver. You need to enable Pods in the cluster to resolve records in the existing corp.internal private zone as well as other zones under .internal.

QUESTION NO: 7
Your product team has web servers running on both us-east1 and us-west1 regions in the prod- servers project. Your security team plans to install an intrusion detection system (IDS) in their own Google Cloud project to inspect the incoming network traffic. What should you do?

QUESTION NO: 8
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
- Each on-premises router is configured with the same ASN.
- Each on-premises router is configured with the same routes and
priorities.
- Both on-premises routers are configured with a VPN connected to a
single Cloud Router.
- The VPN logs have no-proposal-chosen lines when the VPNs are
connecting.
- BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?

QUESTION NO: 9
Your organization's on-premises networking team is reporting frequent BGP session flaps toward your Google Cloud environment. You need to review the BGP configuration. What should you do?

QUESTION NO: 10
Your organization's current architecture has one Shared VPC host project (SH_HOST_PRJ) that contains a single VPC (SH_VPC) and two Shared VPC service projects (SP_ONE_PRJ and SP_TWO_PRJ) that do not contain any VPCs. Each Shared VPC service project belongs to a different team: TEAM_ONE manages SP_ONE_PRJ and TEAM_TWO manages SP_TWO_PRJ.
You must design a solution that allows each team to create their own DNS private zones and DNS records only in their respective Shared VPC service projects. Workloads in SP_ONE_PRJ must be able to resolve all the DNS private zones defined in SP_TWO_PRJ and conversely. Your design must have the least amount of set up effort. What should you do?

QUESTION NO: 11
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
- Each on-premises router is configured with a unique ASN. ?Each on-
premises router is configured with the same routes and priorities.
- Both on-premises routers are configured with a VPN connected to a
single Cloud Router.
- BGP sessions are established between both on-premises routers and the Cloud Router.
- Only 1 of the on-premises router's routes are being added to the
routing table.
What is the most likely cause of this problem?

QUESTION NO: 12
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?

QUESTION NO: 13
You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames.
You want to follow Google-recommended practices. What should you do?

QUESTION NO: 14
Your company distributes software updates using a Cloud Storage bucket fronted by a global external HTTPS Application Load Balancer with Cloud CDN enabled. You uploaded a critical security patch to a file named latest_update.zip. The security patch eliminates a vulnerability that could be exploited by cybercriminals. You need to ensure that all users worldwide immediately receive the new version, and that any previously cached copies of latest_update.zip are purged from the Cloud CDN network. What should you do?