Question 1

You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the intemet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?

Options :

A : Review the VPC audit logs in Cloud Logging for the affected instances.

B : Use Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.

C : Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the Internet.

D : Enable VPC Flow Logs for all VPC, and review the logs in Cloud Logging for the affected instances.

Answer: C

Question 2

Your company's security team tends to use managed services when possible. You need to build a dashboard to show the number of deny hits that occur against configured firewall rules without increasing operational overhead. What should you do?

Options :

A : Configure Firewall Rules Logging. Use Firewall Insights to display the number of hits.

B : Configure Firewall Rules Logging. View the logs in Cloud Logging, and create a custom dashboard in Cloud Monitoring to display the number of hits.

C : Configure a firewall appliance from the Google Cloud Marketplace. Route all traffic through this appliance, and apply the firewall rules at this layer. Use the firewall appliance to display the number of hits.

D : Configure Packet Minoring on the VPC. Apply a filter with an IP address list of the Denied Firewall rules. Configure an intrusion detection system (IDS) appliance as the receiver to display the number of hits.

Answer: A

Question 3

You have the networking configuration shown. In the diagram Two VLAN attachments associated With two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BOP) sessions associated with each Of the VLAN attachments. You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?

Options :

A :

From the Google Cloud console, navigate to the Hybrid Connectivity select the Cloud Router, and view BGP sessions.

B :

From the Cloud CLI, run gcloud compute –protect_ID router get—status mycloudrouter —-region REGION and review the results.

C :

From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results

D :

From the Cloud CLI. run gcloud compute routers describe mycloudrouter --region REGION and review the results

Answer: A

Question 4

You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?

Options :

A : Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.

B : Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.

C : Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.

D : Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field

Answer: B

Question 5

You need to ensure your personal SSH key works on every instance in your project. You want to accomplish

this as efficiently as possible.

What should you do?

Options :

A : Upload your public ssh key to the project Metadata.

B : Upload your public ssh key to each instance Metadata.

C : Create a custom Google Compute Engine image with your public ssh key embedded.

D : Use gcloud compute ssh to automatically copy your public ssh key to the instance.

Answer: A

Higher Test Marks with Free Online Professional-Cloud-Network-Engineer Exam Practice

Buying Options: