Get New 2021 Google exam Professional-Cloud-Network-Engineer Dumps Bundle On flat Updated Dumps!
Full Professional-Cloud-Network-Engineer Practice Test and 80 unique questions with explanations waiting just for you, get it now!
NEW QUESTION 19
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. Client IP and protocol
- B. Client IP
- C. Client IP, port and protocol
- D. None
Answer: B
NEW QUESTION 20
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- B. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
- C. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
- D. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
Answer: B
Explanation:
https://link.springer.com/chapter/10.1007/978-1-4842-1004-8_4
NEW QUESTION 21
All the instances in your project are configured with the custom metadata enable-osloginvalue set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project- wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- B. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- C. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- D. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION 22
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. HTTPS load balancer
- B. TCP proxy load balancer
- C. SSL proxy load balancer
- D. Network load balancer
Answer: C
Explanation:
https://cloud.google.com/security/encryption-in-transit/
NEW QUESTION 23
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- B. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
- C. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- D. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
Answer: D
Explanation:
Once you have the exported file from your other provider, you can use the gcloud dns record-sets import command to import it into your managed zone.
To import record-sets, you use the dns record-sets import command. The --zone-file-format flag tells importto expect a BIND zone formatted file. If you omit this flag, import expects a YAML-formatted records file.
NEW QUESTION 24
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC- native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
- B. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC- native cluster and specify those ranges.
- C. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-aliasto create a VPC-native cluster.
- D. Use gcloud container clusters create [CLUSTER NAME]to create a VPC-native cluster.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters
NEW QUESTION 25
Your developer group works on a set of VM's frequently throughout the day. To save costs, you terminate the VM when it is not in use. However, you need to preserve the contents of the disk when the VM is terminated so users can resume where they left off when a new one is created.
What is the most cost-effective way to do? (Choose two)
- A. Take a snapshot of the disk before terminating the VM.
- B. Back up the disk contents to Cloud Storage before deleting.
- C. Set the disk to no-auto-delete to preserve contents.
- D. When not in use, only stop the instance instead of deleting it.
Answer: C,D
Explanation:
A (Correct Answer) - Set the disk to no-auto-delete to preserve contents. Setting your instance to not delete the root disk when deleting the instance will preserve the disk contents to attach to a new instance.
C (Correct Answer) - When not in use, only stop the instance instead of deleting it. Alternatively, you can merely stop the instance instead of deleting it, during which time you will not be billed for Machine Type usage (just disk storage).
B and D may work but are not suitable solutions since the VMs may need frequently stop and resume throughout the day.
More Information:
https://cloud.google.com/sdk/gcloud/reference/compute/instances/set-disk-auto-delete
NEW QUESTION 26
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Compress files using utilities like tar to reduce the size of data being sent.
- B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- C. Tune TCP parameters on the on-premises servers.
- D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/transferring-big-data-sets-to-gcp
NEW QUESTION 27
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- B. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- C. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- D. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
Answer: A
NEW QUESTION 28
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure a TCP Proxy with the designated IPv6 address.
- B. Create the instance with the designated IPv6 address.
- C. Configure an internal load balancer with the designated IPv6 address.
- D. Configure a global load balancer with the designated IPv6 address.
Answer: D
NEW QUESTION 29
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices.
How should you design this topology?
- A. Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- B. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
- C. Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
- D. Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 30
You have a web application that is currently hosted in the us-central1 region. Users experience high latency when traveling in Asia. You've configured a network load balancer, but users have not experienced a performance improvement. You want to decrease the latency.
What should you do?
- A. Configure an HTTP load balancer, and direct the traffic to it.
- B. Configure a policy-based route rule to prioritize the traffic.
- C. Configure Dynamic Routing for the subnet hosting the application.
- D. Configure the TTL for the DNS zone to decrease the time between updates.
Answer: A
NEW QUESTION 31
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?
- A. One of the VPN sessions is configured incorrectly.
- B. A firewall is blocking the traffic across the second VPN connection.
- C. BGP sessions are not established between both on-premises routers and the Cloud Router.
- D. You do not have a load balancer to load-balance the network traffic.
Answer: D
NEW QUESTION 32
You work for a university that is migrating to GCP.
These are the cloud requirements:
* On-premises connectivity with 10 Gbps
* Lowest latency access to the cloud
* Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost- efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
- B. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- C. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
- D. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
Answer: B
NEW QUESTION 33
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the compute.instanceAdmin to your user account.
- B. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
- C. Grant the iam.serviceAccountUser to your user account.
- D. Grant the read-only privilege to the service account for the Cloud Storage bucket.
Answer: C
NEW QUESTION 34
......
[Dec-2021] Pass Google Professional-Cloud-Network-Engineer Exam in First Attempt Guaranteed: https://drive.google.com/open?id=1AM9rEDaMEY1QusJY2d4EPq1-e-dYIcSk
Reduce Your Chance of Failure in Professional-Cloud-Network-Engineer Exam: https://www.realvce.com/Professional-Cloud-Network-Engineer_free-dumps.html