[Dec 05, 2021] New Real Professional-Cloud-Network-Engineer Exam Dumps Questions
Pass Your Professional-Cloud-Network-Engineer Exam Easily with Accurate Google Cloud Certified - Professional Cloud Network Engineer PDF Questions
Conclusion
Your chances to pass the Google Professional Cloud Network Engineer certification exam are higher if you follow an organized training routine. Thus, you can choose from different preparation resources found online. For example, you can start with the learning path provided by Google and get exposed to different areas dedicated to the Google Cloud platform and network processes. Also, you can complete your knowledge with the study guides and books available on Amazon. In all, with the comprehensive materials, we’ve covered above, you’ll easily clear the upcoming validation.
For more info visit:
CCIE to Google Cloud Network Engineer Google cloud network engineer practice exam Google Cloud documentation Google Cloud solutions Security & Identity Fundamentals
How to Prepare For Google Professional Cloud Network Engineer Exam
Preparation Guide for Google Professional Cloud Network Engineer Exam
Introduction
Google has designed a track for IT professionals to endorse as a cloud Network Engineer on the GCP platform. This accreditation program gives Google cloud professionals a way to endorse their skills. The evaluation relies on a meticulous exam using industry standard methodology to conclude whether or not a aspirant meets GoogleâÂÂs proficiency standards.
According to Google, a Google Certified Professional Cloud Network Engineer facilitate organizations to influence Google Cloud technologies. By leveraging experience implementing VPCs, network services, hybrid connectivity and security for established network architectures, this individual ensures successful cloud implementations using the Google Cloud Platform Console or the command line interface .
Certification is evidence of your skills, expertise in those areas in which you like to work. If candidate wants to work on Google Professional Cloud Network Engineer and prove his knowledge, certification offered by Google. This Google Professional Cloud Network Engineer Certification helps a candidate to validates his skills in Google Professional Cloud Network Engineer Technology.
In this guide, we will cover the Google Professional Cloud Network Engineer Exam, Google Professional Cloud Network Engineer Certified Professionals salary and all aspects of the Google Professional Cloud Network Engineer Certification.
NEW QUESTION 48
You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses.
Which two actions should you take? (Choose two.)
- A. Create a custom static route to allow the traffic to reach the Cloud SQL API.
- B. Activate the Service Networking API in your project.
- C. Activate the Cloud Datastore API in your project.
- D. Create a private connection to a service producer.
- E. Enable Private Google Access.
Answer: B,D
Explanation:
Reference:
https://cloud.google.com/sql/docs/mysql/private-ip
NEW QUESTION 49
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Deploy a new instance group and canary the updated template in that group.
Verify the new feature in the new canary instance group, and then update the original instance group. - B. Manually patch some of the instances, and then perform a rolling restart on the instance group.
- C. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template.
Verify the new feature on the canary instances, and then roll forward to the rest of the instances. - D. Using the new instance template, perform a rolling update across all instances in the instance group.
Verify the new feature once the rollout completes.
Answer: A
Explanation:
https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances
NEW QUESTION 50
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?
- A. Security Admin privileges from the Shared VPC Admin.
- B. Shared VPC Admin privileges from the Organization Admin.
- C. Service Project Admin privileges from the Shared VPC Admin.
- D. Organization Admin privileges from the Organization Admin.
Answer: A
Explanation:
https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 51
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?
- A. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.
- B. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.
- C. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag.
- D. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A.
Answer: B
NEW QUESTION 52
You need to give each member of your network operations team least-privilege access to create, modify, and delete Cloud Interconnect VLAN attachments.
What should you do?
- A. Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get.
- B. Assign each user the compute.networkAdmin role.
- C. Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update.
- D. Assign each user the editor role.
Answer: A
NEW QUESTION 53
You work for a university that is migrating to GCP.
These are the cloud requirements:
* On-premises connectivity with 10 Gbps
* Lowest latency access to the cloud
* Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- B. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
- C. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
- D. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
Answer: A
Explanation:
https://cloud.google.com/interconnect/docs/how-to/dedicated/using-interconnects-other-projects Using Cloud Interconnect with Shared VPC You can use Shared VPC to share your VLAN attachment in a project with other VPC networks. Choosing Shared VPC is preferable if you need to create many projects and would like to prevent individual project owners from managing their connectivity back to your on-premises network. In this scenario, the host project contains a common Shared VPC network usable by VMs in service projects. Because VMs in the service projects use this network, Service Project Admins don't need to create other VLAN attachments or Cloud Routers in the service projects. In this scenario, you must create VLAN attachments and Cloud Routers for a Cloud Interconnect connection only in the Shared VPC host project. The combination of a VLAN attachment and its associated Cloud Router are unique to a given Shared VPC network. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/enabling-multiple-networks-access-same-attachment#using_with
https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 54
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the iam.serviceAccountUserto your user account.
- B. Grant the read-onlyprivilege to the service account for the Cloud Storage bucket.
- C. Grant the compute.instanceAdminto your user account.
- D. Grant the cloud-platformprivilege to the service account for the Cloud Storage bucket.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/access/iam
NEW QUESTION 55
You want to configure a NAT to perform address translation between your on-premises network blocks and GCP.
Which NAT solution should you use?
- A. An instance with IP forwarding enabled
- B. An instance configured with iptables SNAT rules
- C. An instance configured with iptables DNAT rules
- D. Cloud NAT
Answer: D
NEW QUESTION 56
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- A. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone
- B. MANAGED_ZONE
gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE - C. MANAGED_ZONE
- D. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone
Answer: A
Explanation:
Once you have the exported file from your other provider, you can use the gcloud dns record-sets import command to import it into your managed zone.
To import record-sets, you use the dns record-sets import command. The --zone-file-format flag tells importto expect a BIND zone formatted file. If you omit this flag, import expects a YAML-formatted records file.
Reference: https://medium.com/@prashantapaudel/gcp-certification-series-2-4-planning-and-configuring- network-resources-8045ac2cc2ac
NEW QUESTION 57
Your developer group works on a set of VM's frequently throughout the day. To save costs, you terminate the VM when it is not in use. However, you need to preserve the contents of the disk when the VM is terminated so users can resume where they left off when a new one is created.
What is the most cost-effective way to do? (Choose two)
- A. Take a snapshot of the disk before terminating the VM.
- B. Back up the disk contents to Cloud Storage before deleting.
- C. Set the disk to no-auto-delete to preserve contents.
- D. When not in use, only stop the instance instead of deleting it.
Answer: C,D
Explanation:
A (Correct Answer) - Set the disk to no-auto-delete to preserve contents. Setting your instance to not delete the root disk when deleting the instance will preserve the disk contents to attach to a new instance.
C (Correct Answer) - When not in use, only stop the instance instead of deleting it. Alternatively, you can merely stop the instance instead of deleting it, during which time you will not be billed for Machine Type usage (just disk storage).
B and D may work but are not suitable solutions since the VMs may need frequently stop and resume throughout the day.
More Information:
https://cloud.google.com/sdk/gcloud/reference/compute/instances/set-disk-auto-delete
NEW QUESTION 58
You are a admin at XYZ organization. Few of your team members need to use BigQuery Data Transfer Service for Amazon S3 . They want to automatically schedule and manage recurring load jobs from Amazon S3 into BigQuery, they want to run the transfer job every week. They have, Amazon S3 URI for the source data, access key ID , secret access key and Read permission on the data source . What necessary permissions are required for the transfer job creators in BigQuery .
- A. bigquery.transfers.update and bigquery.transfers.get
- B. bigquery.transfer.get and bigquery.data.sets.update
- C. bigquery.transfers.update and bigquery.datasets.update
- D. bigquery.jobs.create and bigquery.transfers.get
Answer: C
Explanation:
Option A is the correct choice because bigquery.transfers.update permissions is needed to create the transfer and bigquery.datasets.update permissions is needed on the target dataset .Also The bigquery.admin predefined Cloud IAM role includes bigquery.transfers.update and bigquery.datasets.update permissions .
Option B is Incorrect because , it is not the required permission for transfer job creators.
Option C and Option D are Incorrect because , they are not the required permission for transfer job creators.
NEW QUESTION 59
You want to create a service in GCP using IPv6.
What should you do?
- A. Create the instance with the designated IPv6 address.
- B. Configure an internal load balancer with the designated IPv6 address.
- C. Configure a TCP Proxy with the designated IPv6 address.
- D. Configure a global load balancer with the designated IPv6 address.
Answer: D
Explanation:
https://cloud.google.com/load-balancing/docs/load-balancing-overview mentions to use global load balancer for IPv6 termination.
NEW QUESTION 60
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?
- A. Security Admin privileges from the Shared VPC Admin.
- B. Shared VPC Admin privileges from the Organization Admin.
- C. Service Project Admin privileges from the Shared VPC Admin.
- D. Organization Admin privileges from the Organization Admin.
Answer: A
Explanation:
A Shared VPC Admin can define a Security Admin by granting an IAM member the Security Admin (compute.securityAdmin) role to the host project. Security Admins manage firewall rules and SSL certificates.
NEW QUESTION 61
You need to centralize the Identity and Access Management permissions and email distribution for the WebServices Team as efficiently as possible.
What should you do?
- A. Create a Google Group for the WebServices Team.
- B. Create a new Custom Role for all members of the WebServices Team.
- C. Create a G Suite Domain for the WebServices Team.
- D. Create a new Cloud Identity Domain for the WebServices Team.
Answer: A
NEW QUESTION 62
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- B. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- C. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- D. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
Answer: C
Explanation:
https://cloud.google.com/vpc/docs/vpc-peering
NEW QUESTION 63
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices.
How should you design this topology?
- A. Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- B. Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- C. Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
- D. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
Answer: D
NEW QUESTION 64
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
- A. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
- B. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
- C. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
- D. Rename the default VPC as "Distribution" and peer it via network peering.
Answer: C
NEW QUESTION 65
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?
- A. Create a new storage bucket, and move the object you don't want to be checked anymore inside it. Then edit the bucket setting and enable the private attribute.
- B. Ensure that the object you don't want to be cached anymore is not shared publicly.
- C. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
- D. Add an appropriate lifecycle rule on the storage bucket containing the two objects.
Answer: B
Explanation:
Reference:
https://developers.google.com/web/ilt/pwa/caching-files-with-service-worker
NEW QUESTION 66
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts.
You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. Client IP, port and protocol
- B. Client IP
- C. Client IP and protocol
- D. None
Answer: B
NEW QUESTION 67
You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even though the cluster is up and running.
What should you do to solve the problem?
- A. Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.
- B. Create a route to reach the Master, pointing to the default internet gateway.
- C. Assign a public IP address to the instance.
- D. Create the appropriate master authorized network entries to allow the instance to communicate to the master.
Answer: A
NEW QUESTION 68
You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.
What should you do?
- A. Try connecting to the instance via SSH, and check the logs.
- B. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
- C. Check the VPC flow logs for the instance.
- D. Create a new firewall rule to allow traffic from port 22, and enable logs.
Answer: B
Explanation:
Ingress packets in VPC Flow Logs are sampled after ingress firewall rules. If an ingress firewall rule denies inbound packets, those packets are not sampled by VPC Flow Logs. We want to see the logs for blocked traffic so we have to look for them in firewall logs. https://cloud.google.com/vpc/docs/flow-logs#key_properties
NEW QUESTION 69
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
- B. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
- C. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- D. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
Answer: A
Explanation:
https://cloud.google.com/network-connectivity/docs/vpn/concepts/classic-topologies#redundancy-options
NEW QUESTION 70
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
GetIamPolicy() via REST API
- A. setIamPolicy() via REST API
- B. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --
- C. role roles/editor
- D. role roles/editor
gcloud projects add-iam-policy-binding Sprojectname --member user:Susername -- - E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
Answer: C,E
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/granting-changing-revoking-access
NEW QUESTION 71
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- B. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
- C. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- D. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
Answer: C
NEW QUESTION 72
You work for one of the biggest digital media company in USA .The company management has decided to move 90 TB of backups and archival data to Google Cloud. They are looking for long term cost effective archival storage for disaster recovery in Google Cloud . Please select the right solution.
- A. gsutil and Cloud storage
- B. Transfer Appliance and Nearline storage
- C. Transfer Appliance and Coldline storage
- D. Storage Transfer and Nearline storage
Answer: C
Explanation:
Option B is the correct choice because ,Transfer Appliance is the best choice moving large volume of data and since they are looking for long term cost effective disaster recovery solution , coldline is the best option.
Option A is Incorrect because Storage Transfer is used to import online data into Cloud Storage .
Your online data source can be an Amazon Simple Storage Service (Amazon S3) bucket, an HTTP/HTTPS location, or a Cloud Storage bucket Option C is Incorrect because , gsutil isn't recommended for large volume of data transfer ,It will take a very long time for data transfer depending on the bandwidth.
Option D is Incorrect because , Coldline is a more cost effective archival storage for disaster recovery.
NEW QUESTION 73
......
Professional-Cloud-Network-Engineer Certification Exam Dumps Questions in here: https://drive.google.com/open?id=1fMxKGq91-JNztjEi8lnUnVNfglX2ucvF
Updated Professional-Cloud-Network-Engineer Exam Practice Test Questions: https://www.prep4sureexam.com/Professional-Cloud-Network-Engineer-dumps-torrent.html