Google Professional Cloud Network Engineer Exam Questions Instant Access

Question 1

Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks. What should you do?

ACreate an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.

BCreate a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.

CCreate a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.

DCreate a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.

Answer : B

Question 2

Your organization wants to seamlessly migrate a global external web application from Compute Engine to GKE. You need to deploy a simple, cloud-first solution that exposes both applications and sends 10% of the requests to the new application. What should you do?

AConfigure a global external Application Load Balancer with a Service Extension that points to an application running in a VM, which controls which requests go to each application.

BConfigure a global external Application Load Balancer with weighted traffic splitting.

CConfigure two separate global external Application Load Balancers, and use Cloud DNS geolocation routing policies.

DConfigure a global external Application Load Balancer with weighted request mirroring.

Answer : B

Weighted traffic splitting allows you to gradually route a percentage of traffic to the new GKE application while still serving the majority of requests through the Compute Engine instance. This gradual transition minimizes risks and ensures seamless traffic distribution during migration.

Question 3

Your company's on-premises office is connected to Google Cloud using HA VPN. The security team will soon enable VPC Service Controls. You need to create a plan with minimal configuration adjustments, so clients at the office will still be able to privately call the Google APIs and be protected by VPC Service Controls. What should you do?

ACreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.4/30; advertise 199.36.153.4/30 from Google Cloud to the onpremises routers; add an access level to authorize the on-premises network to access the APIs.

BCreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.8/30; advertise 199.36.153.8/30 from Google Cloud to the onpremises routers.

CCreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.8/30; advertise 199.36.153.8/30 from Google Cloud to the onpremise routers: add an access level to authorize the on-premises network to access the APIs.

DCreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.4/30; advertise 199.36.153.4/30 from Google Cloud to the onpremises routers.

Answer : C

When integrating on-premises networks with VPC Service Controls for private access to Google APIs, the recommended approach involves using Private Google Access for Hybrid Connectivity and configuring DNS resolution to the restricted.googleapis.com domain. This domain resolves to the 199.36.153.8/30 IP address range. It's crucial to advertise this range from Google Cloud to your on-premises routers so that on-premises clients can route traffic to the Google APIs privately. Additionally, to allow your on-premises network to access the APIs within the VPC Service Controls perimeter, you must define an access level that includes the IP address range of your on-premises network.

Exact Extract:

'To enable private access to Google APIs and services from on-premises networks protected by a VPC Service Controls perimeter, you must configure Private Google Access for Hybrid Connectivity.'

'For on-premises hosts, configure your DNS to resolve *.googleapis.com to restricted.googleapis.com. The restricted.googleapis.com domain resolves to the IP address range 199.36.153.8/30.'

'You must advertise the 199.36.153.8/30 range from your Cloud Routers to your on-premises routers through BGP.'

Question 4

You need to give each member of your network operations team least-privilege access to create, modify, and delete Cloud Interconnect VLAN attachments.

What should you do?

AAssign each user the editor role.

BAssign each user the compute.networkAdmin role.

CGive each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get.

DGive each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update.

Answer : D

https://cloud.google.com/interconnect/docs/how-to/dedicated/creating-vlan-attachments

Question 5

You are the Organization Admin for your company. One of your engineers is responsible for setting up multiple host projects across multiple folders and sharing subnets with service projects. You need to enable the engineer's Identity and Access Management (IAM) configuration to complete their task in the fewest number of steps. What should you do?

ASet up the engineer with Compute Shared VPC Admin IAM role at the folder level.

BSet up the engineer with Compute Shared VPC Admin IAM role at the organization level.

CSet up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the folder level.

DSet up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the organization level.

Answer : B

Question 6

You recently configured Google Cloud Armor security policies to manage traffic to your application. You discover that Google Cloud Armor is incorrectly blocking some traffic to your application. You need to identity the web application firewall (WAF) rule that is incorrectly blocking traffic. What should you do?

AEnable firewall logs, and view the logs in Firewall Insights.

BEnable HTTP(S) Load Balancing logging with sampling rate equal to 1, and view the logs in Cloud Logging.

CEnable VPC Flow Logs, and view the logs in Cloud Logging.

DEnable Google Cloud Armor audit logs, and view the logs on the Activity page in the Google Cloud Console.

Answer : A

Question 7

You need to configure the Border Gateway Protocol (BGP) session for a VPN tunnel you just created between two Google Cloud VPCs, 10.1.0.0/16 and 172.16.0.0/16. You have a Cloud Router (router-1) in the 10.1.0.0/16 network and a second Cloud Router (router-2) in the 172.16.0.0/16 network. Which configuration should you use for the BGP session?

AOption A

BOption B

COption C

DOption D

Answer : C