Question 1

Your organization's security policy requires that all intemet-bound traffic return to your on-premises data center through HA VPN tunnels before egressing to the intemet, while allowing virtual machines (VMs) to leverage private Google APIs using private virtual IP addresses 199.36.153.4/30. You need to configure the routes to enable these traffic flows. What should you do?

Options :

A : Configure a custom route 0.0.0.0/0 with a priority of 500 whose next hop is the default internet gateway. Configure another custom route 199.36.153.4/30 with priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.

B : Configure a custom route 0.0.0.0/0 with a priority of 1000 whose next hop is the intemet gateway. Configure another custom route 199.36.153.4/30 with a priority of 500 whose next hop is the VPN tunnel back to the on-premises data center.

C : Announce a 0.0.0.0/0 route from your on-premises router with a MED of 1000. Configure a custom route 19936153A/30 with a priority of 1000 whose next hop is the default interne gateway.

D : Announce a 0.0.0.0/0 route from your on-premises router with a MED of 500 Configure another custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center

Answer: A

Question 2

You are configuring the final elements of a migration effort where resources have been moved from onpremises to Google Cloud. While reviewing the deployed architecture, you noticed that DNS resolution is failing when queries are being sent to the on-premises environment. You log in to a Compute Engine instance, try to resolve an on-premises hostname, and the query fails. DNS queries are not arriving at the on-premises DNS server. You need to use managed services to reconfigure Cloud DNS to resolve the DNS error. What should you do?

Options :

A :

Validate that the Compute Engine instances are using the Metadata Service IP address as their resolver. Configure an outbound forwarding zone for the on-premises domain pointing to the on-premises DNS server. Configure Cloud Router to advertise the Cloud DNS proxy range to the on-premises network.

B :

Validate that there is network connectivity to the on-premises environment and that the Compute Engine instances can reach other on-premises resources. If errors persist, remove the VPC Network Peerings and recreate the peerings after validating the routes.

C :

Review the existing Cloud DNS zones, and validate that there is a route in the VPC directing traffic destined to the IP address of the DNS servers. Recreate the existing DNS forwarding zones to forward all queries to the on-premises DNS servers.

D :

Ensure that the operating systems of the Compute Engine instances are configured to send DNS queries to the on-premises DNS servers directly

Answer: A

Question 3

You successfully provisioned a single Dedicated Interconnect. The physical connection is at a colocation facility closest to us-west2. Seventy-five percent of your workloads are in us-east& and the remaining twenty-five percent of your workloads are in us-centrall All workloads have the same network traffic profile You need to minimize data transfer costs when deploying MAN attachments. What should you do?

Options :

A : Keep the existing Dedicated interconnect. Deploy a VLAN attachment to a Cloud Router in us-west2, and use VPC global routing to access workloads in us-east4 and us-centrall

B : Keep the existing Dedicated Interconnect. Deploy a VLAN attachment to a Cloud Router in us-east4, and deploy another VLAN attachment to a Cloud Router in us-centrall.

C : Order a new Dedicated Interconnect for a colocation facility closest to us-east4, and use VPC global routing to access workloads in us-centrall.

D : Order a new Dedicated Interconnect for a colocation facility closest to us-centrall, and use VPC global routing to access workloads in us-east4.

Answer: C

Question 4

You have recently been put in charge of managing identity and access management for your organization. You

have several projects and want to use scripting and automation wherever possible. You want to grant the editor

role to a project member.

Which two methods can you use to accomplish this? (Choose two.)

Options :

A : GetIamPolicy() via REST API

B : setIamPolicy() via REST API

C : gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor

D : gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor

E :

Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.

Answer: D,E

Question 5

You have the networking configuration shown. In the diagram Two VLAN attachments associated With two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BOP) sessions associated with each Of the VLAN attachments. You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?

Options :

A :

From the Google Cloud console, navigate to the Hybrid Connectivity select the Cloud Router, and view BGP sessions.

B :

From the Cloud CLI, run gcloud compute –protect_ID router get—status mycloudrouter —-region REGION and review the results.

C :

From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results

D :

From the Cloud CLI. run gcloud compute routers describe mycloudrouter --region REGION and review the results

Answer: A

Higher Test Marks with Free Online Professional-Cloud-Network-Engineer Exam Practice

Buying Options: