🔍

PCNE — questions

Page 11 of 13 · 255 total questions.

PCNE Question 202

Single page →
Topic 1 · Question 202

Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute instances that run these applications have an associated secure tag. What should you do?

  • ADeploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.
  • BDeploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.
  • CDeploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
  • DDeploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.

PCNE Question 203

Single page →
Topic 1 · Question 203

You are implementing hybrid connectivity between your company's data center and Google Cloud. You've already deployed redundant Dedicated Interconnect connections, and are now deploying VLAN attachments in us-central1. You want to use an active/passive approach, where interconnect-1 is active and interconnect-2 is a passive backup. You need to deploy a Cloud Router to enable BGP connectivity. You want to follow Google-recommended practices. What should you do?

  • A1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0 and ASN 65101.2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200 and ASN 65102.3. Configure the on-premises ASN as 65000.
  • B1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0.2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200.3. Configure both Google-side BGP ASNs as 65100.4. Configure the on-premises ASN as 65000. (correct answer)
  • C1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 16550.2. Configure the on-premises ASN as 65001 for primary interconnect-1.3. Configure the on-premises ASN as 65002 for secondary interconnect-2.
  • D1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 4200000001.2. Configure the on-premises ASN as 4200000010.3. Disable the BGP session on the on-premises router for the secondary interconnect-2.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: 1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0.2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200.3. Configure both Google-side BGP ASN...

PCNE Question 204

Single page →
Topic 1 · Question 204

Your organization has multiple VMs running on Google Cloud within a VPC. The VMs require connectivity to certain Google APIs. You need to enable Private Google Access for VM connectivity to Cloud Storage. What should you do?

  • AEnable Private Google Access on the project, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
  • BEnable Private Google Access on the VM, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
  • CEnable Private Google Access on the VPC, create a default route that points to the default internet gateway, and enable the Cloud Storage API.
  • DEnable Private Google Access on the subnet, create a default route that points to the default internet gateway, and enable the Cloud Storage API. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable Private Google Access on the subnet, create a default route that points to the default internet gateway, and enable the Cloud Storage API.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. Private Google Access lets internal instances reach Google APIs without external IPs.

PCNE Question 205

Single page →
Topic 1 · Question 205

You are configuring the final elements of a migration effort where resources have been moved from on-premises to Google Cloud. While reviewing the deployed architecture, you noticed that DNS resolution is failing when queries are being sent to the on-premises environment. You login to a Compute Engine instance, try to resolve an on-premises hostname, and the query fails. DNS queries are not arriving at the on-premises DNS server. You need to use managed services to reconfigure Cloud DNS to resolve the DNS error. What should you do?

  • AEnsure that the operating systems of the Compute Engine instances are configured to send DNS queries to the on-premises DNS servers directly.
  • BValidate that there is network connectivity to the on-premises environment and that the Compute Engine instances can reach other on-premises resources. If errors persist, remove the VPC Network Peerings and recreate the peerings after validating the routes.
  • CValidate that the Compute Engine instances are using the Metadata Service IP address as their resolver. Configure an outbound forwarding zone for the on-premises domain pointing to the on-premises DNS server. Configure Cloud Router to advertise the Cloud DNS proxy range to the on-premises network. (correct answer)
  • DReview the existing Cloud DNS zones, and validate that there is a route in the VPC directing traffic destined to the IP address of the DNS servers. Recreate the existing DNS forwarding zones for . to forward all queries to the on-premises DNS servers.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Validate that the Compute Engine instances are using the Metadata Service IP address as their resolver. Configure an outbound forwarding zone for the on-premises domain pointing to the on-premises DNS server. Configur...

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS. Cloud DNS provides scalable, authoritative DNS with health checks and routing policies.

PCNE Question 206

Single page →
Topic 1 · Question 206

Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?

  • AEnable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
  • BUse Cloud NGFW Essentials. Create a firewall rule for egress traffic, and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
  • CConfigure a TLS agent on every VM to intercept TLS traffic before it reaches the internet. Configure Sensitive Data Protection to analyze and allow/deny the content.
  • DUse Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the --tls-inspect flag, and associate the firewall rules with the VMs. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the --tls-inspect flag, and associate the firewall rules with the VMs.

PCNE Question 207

Single page →
Topic 1 · Question 207

Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue. What should you do?

  • ACreate custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
  • BCreate custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes. (correct answer)
  • CCreate a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
  • DCreate custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 208

Single page →
Topic 1 · Question 208

Your organization has a legacy VPN device that uses IKEv1 and does not support BGP. Connectivity from your on-premises environment to Google Cloud needs to be established. You are using 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24 in your on-premises environment, and 192.168.100.0/24, 192.168.101.0/24, and 192.168.102.0/24 in your Google Cloud environment. You have configured a VPN gateway and you need to configure a policy-based VPN tunnel. What should you do?

  • AConfigure the tunnel with LOCAL_TS set to 172.16.100.0/22 and REMOTE_TS set to 192.168.100.0/22.
  • BConfigure the tunnel with LOCAL_TS set to 192.168.100.0/22 and REMOTE_TS set to 172.16.100.0/22. (correct answer)
  • CConfigure the tunnel with LOCAL_TS set to 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24, and REMOTE_TS set to 192.168.100.0/24,192.168.101.0/24, and 192.168.102.0/24.
  • DConfigure the tunnel with LOCAL_TS set to 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24, and REMOTE_TS set to 0.0.0.0/0.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure the tunnel with LOCAL_TS set to 192.168.100.0/22 and REMOTE_TS set to 172.16.100.0/22.

PCNE Question 209

Single page →
Topic 1 · Question 209

You plan to deploy Google Cloud Armor web application firewall (WAF) policies that use the preconfigured WAF rules. You want all Google Cloud Armor logs to be sent to Cloud Logging with the highest level of detail possible. You have enabled Cloud Load Balancing logs for all the backend services where Cloud Armor WAF policies are applied. What should you do?

  • ASet the sample rate of the Cloud Load Balancing logs to 0.5.
  • BSet the Google Cloud Armor logging option to VERBOSE. (correct answer)
  • CEnable Google Cloud Armor logging for all the backend services where Cloud Armor WAF policies are applied. Set the Google Cloud Armor logging option to VERBOSE.
  • DSet the sample rate of the Cloud Load Balancing logs to 1.0.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set the Google Cloud Armor logging option to VERBOSE.

Explanation

Cloud Armor protects applications from DDoS and common web attacks with WAF rules.

PCNE Question 210

Single page →
Topic 1 · Question 210

Your organization has implemented Vertex AI online prediction in your Google Cloud environment, which is in the us-central1 region. Online prediction is available through private services access by using the IP CIDR range of 172.16.53.0/24. You need to configure access to Vertex AI without affecting the existing routes. You want to use the VLAN attachments that are located in the us-west1 region as primary. The interconnect VLAN attachments in the us-west2 region can only be used as a backup. What should you do?

  • ACreate a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24.
  • BCreate a custom learned route on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
  • CCreate a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200. (correct answer)
  • DCreate a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 200.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments i...

PCNE Question 211

Single page →
Topic 1 · Question 211

As part of your organization's modernization efforts, the application teams are migrating services to GKE on Google Cloud (GKE). The GKE clusters will live in service projects. The teams have validated the applications and configurations in their sandbox projects. When moving to production, you noticed that GKE nodes were not being created. Users were able to create Compute Engine instances, but the operation failed when they tried to create a GKE cluster. You need to enable the application teams so they can create said GKE clusters. What should you do?

  • AEnsure that the service project's GKE service account has the compute.securityAdmin, container.hostServiceAgentUser and compute.networkUser IAM permissions in the host project. (correct answer)
  • BEnsure that the service project's GKE service account has the compute.securityAdmin, container.hostserviceAgentUser and compute.networkUser IAM permissions in the service project.
  • CEnsure that the service project's GKE service account has the compute.networkUser IAM permission in the service project.
  • DReview the firewall rules configuration in the VPC. Identify what rule is blocking node creation.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Ensure that the service project's GKE service account has the compute.securityAdmin, container.hostServiceAgentUser and compute.networkUser IAM permissions in the host project.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCNE Question 212

Single page →
Topic 1 · Question 212

You are implementing a Shared VPC network for your organization, which has distributed teams. One of the application developers works across several teams and notices that they can deploy applications in subnets that are reserved for another application's service projects. You want to ensure that developers can only deploy resources in the subnets that are reserved for their respective service project. What should you do?

  • ASpecify which Shared VPC subnets each application's service projects can access by using the constraints/compute.restrictSharedVpcSubnetworks organizational constraint. (correct answer)
  • BGrant the compute.NetworkViewer role to the developer in the Shared VPC host project.
  • CRestrict another application's project from accessing specific subnets in the host project by using the constraints/compute.restrictSharedVpcHostProject organizational constraint.
  • DGrant the compute.NetworkUser role to the developer in the specific Shared VPC service project.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Specify which Shared VPC subnets each application's service projects can access by using the constraints/compute.restrictSharedVpcSubnetworks organizational constraint.

Explanation

Shared VPC centralizes network administration by sharing one VPC across multiple projects. A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 213

Single page →
Topic 1 · Question 213

You are configuring HA VPN for your organization to connect your on-premises environment to your Google Cloud network. Your on-premises environment is closest to the us-west1 Google Cloud region. You have Google Cloud resources in us-west2, which requires a throughput of 300,000 packets per second (PPS) and an approximate bandwidth of 4 Gbps. You need to have predictable bandwidth management and maintain an SLA of 99.99% with minimal costs. What should you do?

  • ACreate an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 200. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
  • BCreate two HA VPN gateways, each with two tunnels. Configure BGP on each of the gateways' tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the same corresponding multi-exit discriminator (MED) value.
  • CCreate an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value. (correct answer)
  • DCreate an HA VPN gateway with four tunnels. Configure BGP on four tunnels with tunnel 0 configured with a base routing priority metric of 100, tunnel 1 with a base routing priority metric of 200, tunnel 2 with a base routing priority of 300, and tunnel 3 with a base routing priority of 400. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-pr...

PCNE Question 214

Single page →
Topic 1 · Question 214

Your organization mandates that all internal IP addresses used by all database VMs must be statically allocated. While analyzing your VPC IP address allocations, you observed that the database VMs do not have static IP addresses. You need to configure the VPC to follow your organization's mandate without causing any disruption to current operations. What should you do?

  • APromote the internal IP addresses to static assignments for all database VMs. (correct answer)
  • BCreate a firewall rule to allow only traffic to the IP addresses allocated to your database VMs.
  • CDefine a maintenance window to shut down the database VMs one at a time, promote the internal IP address to a static assignment, and restart the VM.
  • DDefine an organization policy to allow only statically allocated IP addresses for VMs. Ensure the prefix matches your database VMs.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Promote the internal IP addresses to static assignments for all database VMs.

PCNE Question 215

Single page →
Topic 1 · Question 215

Your organization deployed a mission critical application that is expected to be a new revenue source. As part of the planning and deployment process, you have recently implemented a security profile with the default set of threat signatures provided by Cloud Next Generation Firewall (Cloud NGFW). This application is the only application running on this project. You need to increase the security posture of the application to log the threat and drop the related packets. What should you do?

  • AConfigure a new default threat signature with Deny All to all severity options. Review the logs to understand the impact.
  • BSet up a Linux VM as the frontend gateway for the application. Create iptables rules to drop all packets, excluding the application port.
  • CFor all severity options (critical, high, medium, low and informational) in the security profile, change the default override action to Deny. (correct answer)
  • DConfigure Cloud Scheduler to run a task that checks the Cloud NGFW logs to verify the threats. Configure the task to create a security profile with each signature ID set to override the default action.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: For all severity options (critical, high, medium, low and informational) in the security profile, change the default override action to Deny.

PCNE Question 216

Single page →
Topic 1 · Question 216

You are configuring a Cross-Cloud Interconnect connection for your Google Cloud organization with two public cloud service providers (CSPs)–CSP 1 and CSP 2. The CSP 1 and CSP 2 environments are closest to Frankfurt, Germany. You can choose between two common colocation locations, Frankfurt and Munich. Your organization's Google Cloud infrastructure is deployed in the North American region, us-east4, which is located in Virginia, USA. The VPC dynamic routing mode has been set to GLOBAL. Your organization requires 20 Gbps of protected bandwidth with a 99.9% Google Cloud SLA. You want to minimize costs where possible. What should you do?

  • A1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany.2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany.3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
  • B1. Create two Cross-Cloud Interconnect connections to CSP 1, with 20 Gbps of total bandwidth (10 Gbps in zone 1 and 10 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany.2. Create two Cross-Cloud Interconnect connections to CSP 2, with 20 Gbps of total bandwidth (10 Gbps in zone 1 and 10 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany.3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2. (correct answer)
  • C1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1) in a common co-location facility located in Frankfurt, Germany and (20 Gbps in zone 2) in a common co-location facility located in Munich, Germany.2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1) in a common co-location facility located in Frankfurt, Germany and (20 Gbps in zone 2) in a common co-location facility located in Munich, Germany.3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
  • D1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany.2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany.3. Create a Cloud Router in us-east4 (Ashburn, Virginia, USA), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 20 Gbps of total bandwidth (10 Gbps in zone 1 and 10 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany.2. Create two Cross...

Explanation

Cloud Interconnect provides a dedicated, private, high-bandwidth link between on premises and Google Cloud. This option delivers the requirement at the lowest cost.

PCNE Question 217

Single page →
Topic 1 · Question 217

Your organization's application is running on a VPC-native GKE Standard cluster with public IP addresses. You need to configure access to the remote address range 35.100.0.0/16 through Cloud NAT, instead of using the GKE nodes' external IP addresses. SNAT is enabled on the cluster and needs to be configured. What should you do?

  • AConfigure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16 range in the list.
  • BConfigure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16 range from the list. (correct answer)
  • CConfigure Cloud NAT and create an exclusion rule for any SNAT address translation.
  • DConfigure Cloud NAT with nonMasqueradeCIDRs, and enable SNAT with the same configuration to allow traffic to 35.100.0.0/16.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16 range from the list.

PCNE Question 218

Single page →
Topic 1 · Question 218

Your organization has approximately 100 teams that need to manage their own environments. A central team must manage the network. You need to design a landing zone that provides separate projects for each team. You must also make sure the solution can scale. What should you do?

  • AConfigure Policy-based Routing for each team.
  • BConfigure a Shared VPC, and create a VPC network in the host project. (correct answer)
  • CConfigure VPC Network Peering, and peer one of the VPC's to the service project.
  • DConfigure a Shared VPC, and create a VPC network in the service project.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure a Shared VPC, and create a VPC network in the host project.

Explanation

Shared VPC centralizes network administration by sharing one VPC across multiple projects. A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 219

Single page →
Topic 1 · Question 219

You are using Network Connectivity Center and you already have the hub configured. All VPCs in your environment need to have network connectivity to each other. All the subnet ranges are unique. You need to configure your topology accordingly. What should you do?

  • AConfigure a star topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
  • BConfigure a mesh topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
  • CConfigure a mesh topology, and add the VPC spokes to the hub. (correct answer)
  • DConfigure a star topology, and add the VPC spokes to the hub.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure a mesh topology, and add the VPC spokes to the hub.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 220

Single page →
Topic 1 · Question 220

You are creating a design that will connect your single on-premises data center to a VPC in Google Cloud by using an IPsec VPN connection. The connection must have a minimum SLA of 99.99%. There is a single VPN termination device located in your on-premises data center. The VPN termination device can be configured only with a single public IP address. Your design must also have the least amount of setup effort. What should you do?

  • A1. Create two HA VPN gateways.2. Create one tunnel on interface 0 of one gateway and create one tunnel on interface 1 of the other gateway.3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
  • B1. Create one Classic VPN gateway and one HA VPN gateway.2. Create one tunnel on the interface of the Classic VPN gateway and one tunnel on interface 1 of the HA VPN gateway.3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
  • C1. Replace the existing on-premises VPN termination device with a new device that is configured with two different public IP addresses.2. Create one HA VPN gateway.3. Create one tunnel for each of the two HA VPN gateway interfaces.4. Terminate each of the two tunnels on one of the two public IP addresses that is configured on the new VPN termination device located in your on-premises data center.
  • D1. Create one HA VPN gateway.2. Create one tunnel for each of the two HA VPN gateway interfaces.3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: 1. Create one HA VPN gateway.2. Create one tunnel for each of the two HA VPN gateway interfaces.3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device loc...

PCNE Question 221

Single page →
Topic 1 · Question 221

Your organization has a highly available application that is not HTTP-based. The application runs on multiple TCP ports and is hosted in multiple regions. You need to design a solution to load balance the application in the same Shared VPC where the service will be accessed. The IP address header must contain the client's true source IP address. No public internet access is required. What should you do?

  • AConfigure multiple regional internal proxy Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
  • BConfigure multiple regional internal Application Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
  • CConfigure a single cross region internal proxy Network Load Balancer.
  • DConfigure multiple regional internal passthrough Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure multiple regional internal passthrough Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.

Explanation

A load balancer distributes traffic across healthy backends in multiple zones for availability and scale. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Showing questions 201–220 of 255 · Page 11 of 13