Professional Cloud Network Engineer Free Practice Questions — Page 6
Question 51
Your organization's on-premises networking team is reporting frequent BGP session flaps toward your Google Cloud environment. You need to review the BGP configuration. What should you do?
A. Switch to static routing.
B. Increase the BGP hold timer to 36000 seconds max.
C. Ensure that graceful restart is enabled on the on-premises router.
D. Ask the on-premises team to enable Bidirectional Forwarding Detection (BFD).
Show Answer
Correct Answer: C
Explanation: Frequent BGP session flaps should prompt verification of BGP features that improve session stability. On Google Cloud Cloud Router, enabling graceful restart on the on-premises router is the recommended configuration to help maintain routing during control-plane restarts and avoid unnecessary BGP session disruption. BFD accelerates failure detection but does not prevent flapping and can make unstable links transition down more quickly. Static routing is not an appropriate replacement, and increasing the hold timer to an extreme value is not recommended.
Question 52
Your organization is connecting their Shared VPC network to their on-premises data center by using Dedicated Interconnect to provide connectivity to all of its service projects. You need to create a design to configure your VLAN attachments and Cloud Routers. You also want to achieve a 99.9% Cloud Interconnect SLA based on Google Cloud s reference design. What should you do?
A. Create two Cloud Interconnect connections in different edge availability domains of two different co-location facilities in a project that will contain your connections. Create one VLAN attachment and Cloud Router for each physical interconnect in the Shared VPC host project.
B. Create two Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create one VLAN attachment for each physical Cloud Interconnect connection and a single Cloud Router in the Shared VPC host project.
C. Create two Cloud Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create one VLAN attachment for each physical interconnect and a single Cloud Router in the service projects.
D. Create two Cloud Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create a Cloud Router in the Shared VPC host project and the VLAN attachments in the Shared VPC service projects.
Show Answer
Correct Answer: B
Explanation: For the 99.9% Dedicated Cloud Interconnect reference design, deploy two Dedicated Interconnect connections in different edge availability domains within the same colocation facility, create one VLAN attachment per physical interconnect, and use a single Cloud Router to establish redundant BGP sessions. In a Shared VPC environment, the Cloud Router and VLAN attachments belong in the Shared VPC host project so connectivity is shared with service projects. Two Cloud Routers are not required for this topology.
Question 53
Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two encrypted VLAN attachments that have a 5 Gbps capacity and a BGP configuration. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?
A. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Configure the HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels. Use the same encrypted Cloud Router used for the Cloud Interconnect tier.
B. Enable MACsec on Partner Interconnect.
C. Enable MACsec for Cloud Interconnect on the VLAN attachments.
D. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Create a new dedicated HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels.
Show Answer
Correct Answer: D
Explanation: HA VPN over Cloud Interconnect uses two separate tiers: the Cloud Interconnect tier (VLAN attachments and its Cloud Router) and the HA VPN tier (HA VPN gateways, tunnels, and a separate Cloud Router for HA VPN). After the encrypted VLAN attachments and Interconnect BGP are operational, you complete the deployment by creating the HA VPN gateway, a dedicated HA VPN Cloud Router, the peer VPN gateway, and HA VPN tunnels. MACsec options are unrelated to HA VPN over Cloud Interconnect.
Question 54
Your organization is using a Shared VPC model. Service project owners want to independently manage their DNS zones in service projects. All service project workloads must be able to resolve all private zones that are defined in other service projects. You need to create a solution that meets these goals. What should you do?
A. Create a Cloud DNS private zone in each service project. Use a Cloud DNS forwarding zone to forward queries to the Shared VPC in the host project.
B. Create a Cloud DNS private zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
C. Create a Cloud DNS response policy zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
D. Create a Cloud DNS private zone in each service project. Use cross-project binding to associate the zones to the Shared VPC in the host project.
Show Answer
Correct Answer: D
Explanation: Cross-project binding allows private Cloud DNS managed zones created in service projects to be bound to the Shared VPC network in the host project. This lets service project owners manage their own private zones independently while making those zones resolvable by workloads attached to the Shared VPC. Forwarding and peering zones do not provide this cross-project private zone association, and response policy zones are for DNS policy overrides rather than authoritative private DNS.
Question 55
You are creating a design that will connect your single on-premises data center to a VPC in Google Cloud by using an IPsec VPN connection. The connection must have a minimum SLA of 99.99%. There is a single VPN termination device located in your on-premises data center. The VPN termination device can be configured only with a single public IP address. Your design must also have the least amount of setup effort. What should you do?
A. 1. Create two HA VPN gateways. 2. Create one tunnel on interface 0 of one gateway and create one tunnel on interface 1 of the other gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
B. 1. Create one Classic VPN gateway and one HA VPN gateway. 2. Create one tunnel on the interface of the Classic VPN gateway and one tunnel on interface 1 of the HA VPN gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
C. 1. Replace the existing on-premises VPN termination device with a new device that is configured with two different public IP addresses. 2. Create one HA VPN gateway. 3. Create one tunnel for each of the two HA VPN gateway interfaces. 4. Terminate each of the two tunnels on one of the two public IP addresses that is configured on the new VPN termination device located in your on-premises data center.
D. 1. Create one HA VPN gateway. 2. Create one tunnel for each of the two HA VPN gateway interfaces. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
Show Answer
Correct Answer: D
Explanation: A single HA VPN gateway with one tunnel on each of its two interfaces satisfies the 99.99% HA VPN SLA requirement. Google Cloud supports terminating both tunnels on the same on-premises peer public IP address (1 peer, 1 external IP topology), so there is no need to replace the on-premises device or deploy additional HA VPN gateways. This also requires the least setup effort.
Question 56
You are using Network Connectivity Center and you already have the hub configured. All VPCs in your environment need to have network connectivity to each other. All the subnet ranges are unique. You need to configure your topology accordingly. What should you do?
A. Configure a star topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
B. Configure a mesh topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
C. Configure a mesh topology, and add the VPC spokes to the hub.
D. Configure a star topology, and add the VPC spokes to the hub.
Show Answer
Correct Answer: C
Explanation: To provide full connectivity between all VPCs attached to an existing Network Connectivity Center hub, configure a mesh topology and add each VPC as a spoke. Because all subnet ranges are unique, there is no need to configure excludeExportRanges filters; those filters are used to prevent exporting selected routes, which is unnecessary here.
Question 57
Your company deployed Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise). You have already created a CA pool and a CA in Certificate Authority Service. You need to enable TLS inspection. What should you do?
A. Grant the network security service agent service account the privateca.certificateRequester role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
B. Grant the network security service agent service account the privateca.poolReader role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
C. Grant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager Flip the TLS inspection flag in your firewall policy rules to true.
D. Grant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager. Flip the TLS inspection flag in your firewall policy rules to true.
Show Answer
Correct Answer: A
Explanation: To enable TLS inspection in Cloud NGFW Enterprise, you must grant the Network Security service agent the Private CA Certificate Requester role so it can obtain certificates from the CA pool, create a TLS inspection policy that references the CA pool, associate that TLS inspection policy with the relevant firewall endpoint association, and enable TLS inspection in the applicable firewall policy rules. The poolReader role is insufficient because the service must request certificates, and creating only a Certificate Manager trust config does not replace the required TLS inspection policy workflow.
Question 58
You have several VMs across multiple VPCs in your cloud environment, which require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to use Cloud NAT to provide outbound internet access. Within your VPCs, you have several subnets in each region. You want to ensure that only specific subnets have access to the internet through Cloud NAT. You want to avoid any unintentional configuration issues caused by other administrators, and align to Google-recommended practices. What should you do?
A. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure all primary and secondary subnet source ranges.
B. Create a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.
C. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure a custom source range that includes the allowed subnets.
D. Deploy Cloud NAT in each VPC, and configure a custom source range that includes the allowed subnets. Configure Cloud NAT rules to only permit the allowed subnets to egress through Cloud NAT.
Show Answer
Correct Answer: B
Explanation: The recommended approach is to restrict which subnets can use Cloud NAT through organization policy, providing centralized enforcement that prevents accidental configuration changes by other administrators. Then configure the Cloud NAT gateway to include only the approved subnets. Firewall rules do not control whether Cloud NAT is available to a subnet, and the options referring to custom source ranges or Cloud NAT rules are not the appropriate mechanism for subnet selection in this scenario.
Question 59
Your company uses Compute Engine instances that are exposed to the public internet. Each compute instance has a single network interface with a single public IP address. You need to block any connection attempt that originates from internet clients with IP addresses that belong to the BGP_ASN_TOBLOCK BGP ASN. What should you do?
A. Create a new Cloud Armor backend security policy, and use the --network-src-asns parameter.
B. Create a new Cloud Armor network edge security policy, and use the --network-src-asns parameter.
C. Create a new Cloud Armor edge security policy, and use the --network-src-asns parameter.
D. Create a new firewall policy ingress rule, and use the --network-src-asns parameter.
Show Answer
Correct Answer: B
Explanation: Compute Engine instances with public IPs that are not behind an external HTTP(S) load balancer can be protected with Cloud Armor network edge security policies. Network edge security policies support matching on source BGP Autonomous System Numbers using the --network-src-asns parameter. Backend security policies are for load-balanced backends, edge security policies are for CDN/load-balancing use cases rather than direct VM public IP protection, and firewall policies do not support ASN-based matching.
Question 60
Your team deployed two applications in GKE that are exposed through an external Application Load Balancer. When queries are sent to www.mountkirkgames.com/sales and www.mountkirkgames.com/get-an-analysis, the correct pages are displayed. However, you have received complaints that www.mountkirkgames.com yields a 404 error. You need to resolve this error. What should you do?
A. Review the Service YAML file. Add a new path rule for the * character that directs to the base service. Reapply the YAML.
B. Review the Ingress YAML file. Add a new path rule for the * character that directs to the base service. Reapply the YAML.
C. Review the Ingress YAML file. Define the default backend. Reapply the YAML.
D. Review the Service YAML file. Define a default backend. Reapply the YAML.
Show Answer
Correct Answer: C
Explanation: The path-specific routes are working, so the Ingress rules for /sales and /get-an-analysis are functioning. A request to the root path that returns 404 indicates there is no matching rule and no default backend configured. In GKE Ingress, the default backend is defined in the Ingress resource, not the Service. Adding a wildcard path is not the correct fix for handling unmatched requests; defining the Ingress default backend is.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.