Question 1

Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?

Options :

A : Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.

B : Create a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.

C : Create two hierarchical firewall policies per department-s folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.

D : Create two hierarchical firewall policies per department-s folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.

Answer: B

Question 2

Your company recently migrated to Google Cloud in a Single region. You configured separate Virtual Private

Cloud (VPC) networks for two departments. Department A and Department B. Department A has requested

access to resources that are part Of Department Bis VPC. You need to configure the traffic from private IP

addresses to flow between the VPCs using multi-NIC virtual machines (VMS) to meet security requirements

Your configuration also must

• Support both TCP and UDP protocols

• Provide fully automated failover

• Include health-checks

Require minimal manual Intervention In the client VMS

Which approach should you take?

Options :

A : Create the VMS In the same zone, and configure static routes With IP addresses as next hops.

B : Create the VMS in different zones, and configure static routes with instance names as next hops

C :

Create an Instance template and a managed instance group. Configure a Single internal load balancer, and define a custom static route with the Internal TCP/UDP load balancer as the next hop

D :

Create an instance template and a managed instance group. Configure two separate internal TCP/IJDP load balancers for each protocol (TCP!UDP), and configure the client VIVIS to use the internal load balancers' virtual IP addresses

Answer: D

Question 3

You need to define an address plan for a future new Google Kubernetes Engine (GKE) cluster in your Virtual Private Cloud (VPC). This will be a VPC-native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses. Which subnet mask should you use for the Pod IP address range?

Options :

A : /21

B : /22

C : /23

D : /25

Answer: A

Question 4

You are adding steps to a working automation that uses a service account to authenticate. You need to drive

the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the

least privilege possible.

What should you do?

Options :

A : Grant the compute.instanceAdmin to your user account.

B : Grant the iam.serviceAccountUser to your user account.

C : Grant the read-only privilege to the service account for the Cloud Storage bucket.

D : Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.

Answer: C

Question 5

You need to enable Cloud CDN for all the objects inside a storage bucket. You want to ensure that all the

object in the storage bucket can be served by the CDN.

What should you do in the GCP Console?

Options :

A : Create a new cloud storage bucket, and then enable Cloud CDN on it.

B : Create a new TCP load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.

C : Create a new SSL proxy load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.

D : Create a new HTTP load balancer, select the storage bucket as a backend, enable Cloud CDN on the backend, and make sure each object inside the storage bucket is shared publicly

Answer: D

Higher Test Marks with Free Online Professional-Cloud-Network-Engineer Exam Practice

Buying Options: