Question 1

You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.

What should you do?

Options :

A : Check the VPC flow logs for the instance.

B : Try connecting to the instance via SSH, and check the logs.

C : Create a new firewall rule to allow traffic from port 22, and enable logs.

D : Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.

Answer: D

Question 2

Your organization's security policy requires that all intemet-bound traffic return to your on-premises data center through HA VPN tunnels before egressing to the intemet, while allowing virtual machines (VMs) to leverage private Google APIs using private virtual IP addresses 199.36.153.4/30. You need to configure the routes to enable these traffic flows. What should you do?

Options :

A : Configure a custom route 0.0.0.0/0 with a priority of 500 whose next hop is the default internet gateway. Configure another custom route 199.36.153.4/30 with priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.

B : Configure a custom route 0.0.0.0/0 with a priority of 1000 whose next hop is the intemet gateway. Configure another custom route 199.36.153.4/30 with a priority of 500 whose next hop is the VPN tunnel back to the on-premises data center.

C : Announce a 0.0.0.0/0 route from your on-premises router with a MED of 1000. Configure a custom route 19936153A/30 with a priority of 1000 whose next hop is the default interne gateway.

D : Announce a 0.0.0.0/0 route from your on-premises router with a MED of 500 Configure another custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center

Answer: A

Question 3

After a network change window one of your company’s applications stops working. The application uses an on-premises database server that no longer receives any traffic from the application. The database server IP address is 10.2.1.25. You examine the change request, and the only change is that 3 additional VPC subnets were created. The new VPC subnets created are 10.1.0.0/16, 10.2.0.0/16, and 10.3.1.0/24/ The on-premises router is advertising 10.0.0.0/8.

What is the most likely cause of this problem?

Options :

A : The less specific VPC subnet route is taking priority.

B : The more specific VPC subnet route is taking priority.

C : The on-premises router is not advertising a route for the database server.

D : A cloud firewall rule that blocks traffic to the on-premises database server was created during the change

Answer: B

Question 4

You need to give each member of your network operations team least-privilege access to create, modify, and

delete Cloud Interconnect VLAN attachments.

What should you do?

Options :

A : Assign each user the editor role.

B : Assign each user the compute.networkAdmin role.

C :

Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get.

D :

Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update.

Answer: D

Question 5

Your company recently migrated to Google Cloud in a Single region. You configured separate Virtual Private

Cloud (VPC) networks for two departments. Department A and Department B. Department A has requested

access to resources that are part Of Department Bis VPC. You need to configure the traffic from private IP

addresses to flow between the VPCs using multi-NIC virtual machines (VMS) to meet security requirements

Your configuration also must

• Support both TCP and UDP protocols

• Provide fully automated failover

• Include health-checks

Require minimal manual Intervention In the client VMS

Which approach should you take?

Options :

A : Create the VMS In the same zone, and configure static routes With IP addresses as next hops.

B : Create the VMS in different zones, and configure static routes with instance names as next hops

C :

Create an Instance template and a managed instance group. Configure a Single internal load balancer, and define a custom static route with the Internal TCP/UDP load balancer as the next hop

D :

Create an instance template and a managed instance group. Configure two separate internal TCP/IJDP load balancers for each protocol (TCP!UDP), and configure the client VIVIS to use the internal load balancers' virtual IP addresses

Answer: D

Higher Test Marks with Free Online Professional-Cloud-Network-Engineer Exam Practice

Buying Options: