Professional-Cloud-Network-Engineer Training & Certification Get Latest Google Cloud Platform Updated on May 31, 2025
Certification Training for Professional-Cloud-Network-Engineer Exam Dumps Test Engine
NEW QUESTION # 67
Your frontend application VMs and your backend database VMs are all deployed in the same VPC but across different subnets. Global network firewall policy rules are configured to allow traffic from the frontend VMs to the backend VMs. Based on a recent compliance requirement, this traffic must now be inspected by network virtual appliances (NVAs) firewalls that are deployed in the same VPC. The NVAs are configured to be full network proxies and will source NAT-allowed traffic. You need to configure VPC routing to allow the NVAs to inspect the traffic between subnets. What should you do?
- A. Place your NVAs behind an internal passthrough Network Load Balancer named ilb1. Add global network firewall policy rules to allow traffic through your NVAs. Create a policy-based route (PBR) with the source IP range of the frontend VM subnet, destination IP range of the backend VM subnet, and the next hop of ilb1. Scope the PBR to the VMs with the frontend network tag. Add a frontend network tag to your frontend servers.
- B. Place your NVAs behind an internal passthrough Network Load Balancer named ilb1. Add global network firewall policy rules to allow traffic through your NVAs. Create a custom static route with the destination IP range of the backend VM subnet, frontend instance tag, and the next hop of ilb1. Add a frontend network tag to your frontend VMs.
- C. Place your NVAs behind an internal passthrough Network Load Balancer named ilb1. Add the global network firewall policy rules to allow traffic through your NVAs. Create a policy-based route (PBR) with the source IP range of the backend VM subnet, destination IP range of the frontend VM subnet, and the next hop of ilb1. Scope the PBR to the VMs with the backend network tag. Add a backend network tag to your backend servers.
- D. Create your NVA with multiple interfaces. Configure NIC0 for NVA in the backend subnet. Configure NIC1 for NVA in the frontend subnet. Place your NVAs behind an internal passthrough Network Load Balancer named ilb1. Add global network firewall policy rules to allow traffic through your NVAs. Create a custom static route with the destination IP range of the backend VM subnet, frontend instance tag, and the next hop of ilb1. Add a frontend network tag to your frontend VMs.
Answer: A
Explanation:
The correct solution requires creating a policy-based route (PBR) to force the traffic from the frontend subnet to the backend subnet through the NVA. The PBR should be scoped to the frontend VMs, with the next hop being the passthrough load balancer (ilb1) behind which the NVAs reside. This ensures that all traffic is inspected by the NVA before reaching the backend.
NEW QUESTION # 68
You are designing the architecture for your organization so that clients can connect to certain Google APIs. Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?
- A. Configure Private Google Access on the VPC resource. Create a default route to the internet.
- B. Configure Private Google Access on the subnet resource. Create a default route to the internet.
- C. Configure a global Secure Web Proxy and remove the default route to the internet.
- D. Configure Cloud NAT and remove the default route to the internet.
Answer: B
Explanation:
Enabling Private Google Access on the subnet allows VMs to access Google APIs (like Cloud Storage and BigQuery) directly, without routing traffic over the internet. This approach is cloud-native and involves minimal setup, aligning with a cloud-first strategy.
NEW QUESTION # 69
You recently deployed Cloud VPN to connect your on-premises data center to Google Cloud. You need to monitor the usage of this VPN and set up alerts in case traffic exceeds the maximum allowed. You need to be able to quickly decide whether to add extra links or move to a Dedicated Interconnect. What should you do?
- A. In the Monitoring section of the Google Cloud console, use the Dashboard section to select a default dashboard for VPN usage.
- B. In Network Intelligence Center, check for the number of packet drops on the VPN.
- C. In the VPN section of the Google Cloud console, select the VPN under hybrid connectivity and then select monitoring to display utilization on the dashboard.
- D. In the Google Cloud console, use Monitoring Query Language to create a custom alert for bandwidth utilization.
Answer: D
Explanation:
Explanation: Using Monitoring Query Language (MQL) to create a custom alert for bandwidth utilization gives you flexibility and precision in setting thresholds. This helps you quickly determine when VPN traffic exceeds the limits, allowing for timely decisions about adding more links or transitioning to a Dedicated Interconnect.
NEW QUESTION # 70
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
* Your ISP is a Google Partner Interconnect provider.
* Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.
* A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses.
* Most of the data transfer will be from GCP to the on-premises environment.
* The application can burst up to 1.5 Gbps during peak transfers over the Interconnect.
* Cost and the complexity of the solution should be minimal.
How should you provision the connectivity solution?
- A. Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
- B. Provision a Partner Interconnect through your ISP.
- C. Use network compression over your VPN to increase the amount of data you can send over your VPN.
- D. Provision a Dedicated Interconnect instead of a VPN.
Answer: A
NEW QUESTION # 71
You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer You must ensure that your application meets the following requirements
* Maps multiple existing reserved external IP addresses to the Instance
* Processes IP Encapsulating Security Payload (ESP) traffic
What should you do?
- A. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
- B. Configure a target pool, and create protocol forwarding rules for each external IP address.
- C. Configure the Compute Engine Instances' network Interface external IP address from None to Ephemeral Add as many external IP addresses as required
- D. Configure a backend service, and create an external network load balancer for each external IP address
Answer: A
Explanation:
The correct answer is C. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
This answer is based on the following facts:
A target instance is a Compute Engine instance that handles traffic from one or more forwarding rules1. You can use target instances to forward traffic to a single VM instance from one or more external IP addresses2.
A protocol forwarding rule specifies the IP protocol and port range for the traffic that you want to forward3. You can use protocol forwarding rules to forward traffic of any IP protocol, including ESP4.
The other options are not correct because:
Option A is not possible. You cannot create protocol forwarding rules for a target pool. A target pool is a group of instances that receives traffic from a network load balancer5.
Option B is not suitable. You do not need to create an external network load balancer for each external IP address. An external network load balancer distributes traffic among multiple backend instances based on the destination IP address and port. You can use a single load balancer with multiple forwarding rules to map multiple external IP addresses to the same backend service.
Option D is not feasible. You cannot add multiple external IP addresses to a single network interface of a Compute Engine instance. Each network interface can have only one external IP address that is either ephemeral or static. You can use alias IP ranges to assign multiple internal IP addresses to a single network interface, but not external IP addresses.
NEW QUESTION # 72
You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?
- A. Create one OpenVPN Access Server in each region of your VPC and your partner's VPC. Connect your servers to the partner's servers.
- B. Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways. Enable global dynamic routing in each VPC.
- C. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner's VPC. Connect your VPN gateway to your partner's servers.
- D. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways with a pair of tunnels. Enable global dynamic routing in each VPC.
Answer: B
NEW QUESTION # 73
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
- B. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
- C. Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.
- D. Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
Answer: B
Explanation:
https://cloud.google.com/load-balancing/docs/health-check-concepts#content-based_health_checks
NEW QUESTION # 74
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
- B. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- C. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
- D. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
Answer: A
NEW QUESTION # 75
You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner.
What should you first?
- A. Run gcloud compute interconnect attachments partner update <attachment> / -- region <region> --admin-enabled.
- B. Log in to your partner's portal and request the VLAN attachment there.
- C. Ask your Interconnect partner to provision a physical connection to Google.
- D. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
Answer: C
Explanation:
Reference:
https://cloudplatform.googleblog.com/2018/06/Partner-Interconnect-now-generally-available.html
NEW QUESTION # 76
You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer You must ensure that your application meets the following requirements
* Maps multiple existing reserved external IP addresses to the Instance
* Processes IP Encapsulating Security Payload (ESP) traffic
What should you do?
- A. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
- B. Configure a target pool, and create protocol forwarding rules for each external IP address.
- C. Configure the Compute Engine Instances' network Interface external IP address from None to Ephemeral Add as many external IP addresses as required
- D. Configure a backend service, and create an external network load balancer for each external IP address
Answer: A
Explanation:
The correct answer is C. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
This answer is based on the following facts:
* A target instance is a Compute Engine instance that handles traffic from one or more forwarding rules1.
You can use target instances to forward traffic to a single VM instance from one or more external IP addresses2.
* A protocol forwarding rule specifies the IP protocol and port range for the traffic that you want to forward3. You can use protocol forwarding rules to forward traffic of any IP protocol, including ESP4.
* The other options are not correct because:
* Option A is not possible. You cannot create protocol forwarding rules for a target pool. A target pool is a group of instances that receives traffic from a network load balancer5.
* Option B is not suitable. You do not need to create an external network load balancer for each external IP address. An external network load balancer distributes traffic among multiple backend instances based on the destination IP address and port. You can use a single load balancer with multiple forwarding rules to map multiple external IP addresses to the same backend service.
* Option D is not feasible. You cannot add multiple external IP addresses to a single network interface of a Compute Engine instance. Each network interface can have only one external IP address that is either ephemeral or static. You can use alias IP ranges to assign multiple internal IP addresses to a single network interface, but not external IP addresses.
NEW QUESTION # 77
You have configured Cloud CDN using HTTP(S) load balancing as the origin for cacheable content. Compression is configured on the web servers, but responses served by Cloud CDN are not compressed.
What is the most likely cause of the problem?
- A. The web servers behind the load balancer are configured with different compression types.
- B. You have configured the web servers and Cloud CDN with different compression types.
- C. You have to configure the web servers to compress responses even if the request has a Via header.
- D. You have not configured compression in Cloud CDN.
Answer: C
Explanation:
If responses served by Cloud CDN are not compressed but should be, check that the web server software running on your instances is configured to compress responses. By default, some web server software will automatically disable compression for requests that include a Via header. The presence of a Via header indicates the request was forwarded by a proxy. HTTP proxies such as HTTP(S) load balancing add a Via header to each request as required by the HTTP specification. To enable compression, you may have to override your web server's default configuration to tell it to compress responses even if the request had a Via header.
NEW QUESTION # 78
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?
- A. Create network tags to allow connectivity between all three VPCs.
- B. Configure VPC peering in a full mesh.
- C. Alter the routing table to resolve the asymmetric route.
- D. Delete the legacy network and recreate it to allow transitive peering.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/using-vpc-peering
NEW QUESTION # 79
You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the internet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?
- A. Review the VPC audit logs in Cloud Logging for the affected instances.
- B. Enable VPC Flow Logs for all VPCs, and review the logs in Cloud Logging for the affected instances.
- C. Use Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.
- D. Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.
Answer: D
NEW QUESTION # 80
Your organization has a Google Cloud Virtual Private Cloud (VPC) with subnets in us-east1, us-west4, and europe-west4 that use the default VPC configuration. Employees in a branch office in Europe need to access the resources in the VPC using HA VPN. You configured the HA VPN associated with the Google Cloud VPC for your organization with a Cloud Router deployed in europe-west4. You need to ensure that the users in the branch office can quickly and easily access all resources in the VPC. What should you do?
- A. Configure the VPC dynamic routing mode to Global.
- B. Configure each subnet's VPN connections to use Cloud VPN to connect to the branch office.
- C. Create custom advertised routes for each subnet.
- D. Set the advertised routes to Global for the Cloud Router.
Answer: A
NEW QUESTION # 81
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
- B. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
- C. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
- D. Manually patch some of the instances, and then perform a rolling restart on the instance group.
Answer: C
NEW QUESTION # 82
You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem.
What should you do?
- A. Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
- B. Explicitly reference the custom mode networks in the Deployment Manager templates.
- C. Explicitly reference the custom mode networks in the Cloud Armor whitelist.
- D. Apply an additional IAM role to the Google API's service account to allow custom mode networks.
Answer: B
NEW QUESTION # 83
......
The Google Professional-Cloud-Network-Engineer exam for the Google Professional-Cloud-Network-Engineer certification tests the candidate's knowledge and skills in several key areas. These include designing, implementing, and managing networks on the Google Cloud Platform, including virtual private clouds, subnets, and firewalls. Professional-Cloud-Network-Engineer exam also covers network security, load balancing, and network optimization techniques, as well as the use of Google Cloud Platform tools and services for network monitoring and management.
Step by Step Guide to Prepare for Professional-Cloud-Network-Engineer Exam: https://easypass.examsreviews.com/Professional-Cloud-Network-Engineer-pass4sure-exam-review.html