🔍

PCNE — questions

Page 13 of 13 · 255 total questions.

PCNE Question 242

Single page →
Topic 1 · Question 242

Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?

  • AConfigure HA VPN by using high availability gateways and tunnels.
  • BConfigure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.
  • CConfigure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.
  • DConfigure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.

Explanation

Partner Interconnect provides private connectivity to Google Cloud through a service provider.

PCNE Question 243

Single page →
Topic 1 · Question 243

Your company’s web application was just deployed on Compute Engine VMS in multiple Google Cloud regions. You have created multiple instance groups and you need to distribute traffic between these VMs. You want your users to automatically connect to the backend that is located in the closest region while following Google-recommended practices. What should you do?

  • ACreate one global external Application Load Balancer and multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
  • BCreate one global external Application Load Balancer and one backend service with multiple backends. Point each backend to a different instance group. (correct answer)
  • CCreate two global external Application Load Balancers with one backend service and one backend. Point each back end to a different instance group.
  • DCreate two global external Application Load Balancers with multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create one global external Application Load Balancer and one backend service with multiple backends. Point each backend to a different instance group.

Explanation

A load balancer distributes traffic across healthy backends in multiple zones for availability and scale.

PCNE Question 244

Single page →
Topic 1 · Question 244

Your company uses Network Connectivity Center to connect its VPCs in Google Cloud. They plan to connect their on-premises data center to one of these VPCs by using HA VPN. The CIDR range of your on-premises network overlaps with the IP addresses in Google Cloud. You want your VMs in Google Cloud to connect directly to the IP address of the on-premises hosts. What should you do?

  • AConfigure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud application load balancer.
  • CConfigure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud TCP proxy load balancer.
  • DConfigure a subnet of purpose PRIVATE_NAT and use Private NAT for the Network Connectivity Center spokes.
  • EConfigure a subnet of purpose PRIVATE_NAT and use Hybrid NAT. (correct answer)
Reveal answer & explanation
Correct answer: E

The correct answer is E. Option E: Configure a subnet of purpose PRIVATE_NAT and use Hybrid NAT.

PCNE Question 245

Single page →
Topic 1 · Question 245

Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two VLAN attachments. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?

  • ACreate an HA VPN gateway and associate the gateway with your two VLAN attachments. Use the existing Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
  • BCreate an HA VPN gateway and associate the gateway with your two VLAN attachments. Create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels. (correct answer)
  • CEnable MACsec on the VLAN attachments.
  • DEnable MACsec on Partner Cloud Interconnect.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.

PCNE Question 246

Single page →
Topic 1 · Question 246

Your organization wants to deploy an internal application named app-1 in VPC-1. The application will consume services from another internal application named app-2 in VPC-2. VPC Network Peering will connect both applications. You need to apply microsegmentation between these two applications and VPCs. What should you do?

  • AAssign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
  • BAssign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
  • CAssign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure an ingress VPC firewall rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
  • DAssign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a network firewall policy that is attached to VPC-2 with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a network firewall policy that is attached to VPC-2 with an ingress rule that allows traffic from secure-tag...

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 247

Single page →
Topic 1 · Question 247

You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. The connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?

  • ACreate a Connectivity Test. Review the results for configuration issues in the VPC routing table.
  • BEnable and review Cloud Logging for Cloud Armor. Look for logs with errors that match the destination IP address of the public SaaS provider.
  • CEnable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider. (correct answer)
  • DEnable the Firewall Insights API. Set the Deny rule insights observation period to one day. Review Insight results to assure there are no firewall rules denying traffic.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider.

Explanation

Cloud NAT lets private instances reach the internet for outbound traffic without external IPs. Cloud Logging centralizes, stores, and analyzes logs across services.

PCNE Question 248

Single page →
Topic 1 · Question 248

You are designing a Google Kubernetes Engine cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 Services. Because of the migration of new Services over the next two years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 Services. You want to use VPC-native clusters with alias IP address ranges, while minimizing address consumption. How should you design this topology?

  • ACreate a subnet of size /28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the Services are ready to be deployed, resize the subnets.
  • BUse gcloud container clusters create [CLUSTER_NAME]--enable-ip-alias to create a VPC-native Cluster.
  • CCreate a subnet of size /25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges. (correct answer)
  • DUse gcloud container clusters create [CLUSTER_NAME] to create a VPC-native Cluster.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a subnet of size /25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 249

Single page →
Topic 1 · Question 249

Your organization is migrating workloads from AWS to Google Cloud. Because a particularly critical workload will take longer to migrate, you need to set up Google Cloud CDN and point it to the existing application at AWS. What should you do?

  • A• Create an internet NEG that points to the existing FQDN of the application.• Map the NEG to an Application Load Balancer as a backend service.• Enable Cloud CDN on the backend service. (correct answer)
  • B• Create a hybrid NEG that points to the existing IP of the application.• Map the NEG to a passthrough Network Load Balancer as a target pool.• Enable Cloud CDN on the target pool.
  • C• Create an internet NEG that points to the existing FQDN of the application.• Map the NEG to a passthrough Network Load Balancer as a backend service.• Enable Cloud CDN on the backend service.
  • D• Create a hybrid NEG that points to the existing IP of the application.• Map the NEG to an Application Load Balancer as a backend service.• Enable Cloud CDN on the backend service.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: • Create an internet NEG that points to the existing FQDN of the application.• Map the NEG to an Application Load Balancer as a backend service.• Enable Cloud CDN on the backend service.

Explanation

Cloud CDN caches content at Google edge locations to reduce latency and offload origins. A load balancer distributes traffic across healthy backends in multiple zones for availability and scale.

PCNE Question 250

Single page →
Topic 1 · Question 250

Your company utilizes Network Connectivity Center (NCC) to facilitate communication between numerous spoke VPCs. A development team reports that their application instances in app-dev-spoke-vpc are unable to connect to a new database service located in db-dev-spoke-vpc. You need to diagnose this issue using an observability tool and determine the root cause. What should you do?

  • AUse Firewall Insights to analyze the firewall rule configuration and modify the appropriate rule.
  • BCheck each firewall rule in both the app-dev-spoke-vpc and db-dev-spokevpc.
  • CVerify that the application instances in app-dev-spoke-vpc connected to Network Connectivity Center are assigned external IP addresses to reach the database service.
  • DUse Network Intelligence Center’s Connectivity Tests to perform a reachability analysis between an instance in app-dev-spoke-vpc and the database service in db-dev-spoke-vpc. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Network Intelligence Center’s Connectivity Tests to perform a reachability analysis between an instance in app-dev-spoke-vpc and the database service in db-dev-spoke-vpc.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 251

Single page →
Topic 1 · Question 251

Your company acquired a new division. The new division's network team requires complete control over their networking infrastructure. You need to extend your existing Google Cloud network infrastructure, that consists of a single VPC, to allow workloads from all divisions to communicate with each other. You want to avoid incurring extra costs and granting unnecessary permissions to the new division's networking team. What should you do?

  • A• Create a new project for the new division's network team.• Create a new VPC within the new project.• Establish a VPC peering between your existing VPC and the new division’s VPC.• Create a new subnet dedicated to the new division's workloads.• Grant roles/compute.networkUser on the new project to the new division’s network team group.
  • B• Create a new project for the new division's network team.• Create a new VPC within the new project.• Establish a VPC peering between your existing VPC and the new division’s VPC.• Grant roles/compute.networkAdmin on the newly created project to the new division's network team group. (correct answer)
  • C• Ensure that the project hosting the existing network infrastructure is enabled as a host project.• Create a new subnet dedicated to the new division's workloads in the existing VPC.• Grant roles/compute.networkUser on the newly created subnet to the new division’s network team group.
  • D• Create a new project for the new division's network team.• Create a new VPC within the new project.• Establish a VPN connection between your existing VPC and the new division's VPC.• Grant roles/compute.networkAdmin on the newly created project to the new division's network team group.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: • Create a new project for the new division's network team.• Create a new VPC within the new project.• Establish a VPC peering between your existing VPC and the new division’s VPC.• Grant roles/compute.networkAdmin on...

Explanation

VPC Network Peering privately connects two VPC networks without a gateway. A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 252

Single page →
Topic 1 · Question 252

Your company is implementing new rules for outbound internet traffic in your Google Cloud environment. You need to design a configuration that enables all outbound internet traffic from virtual machines tagged with production-critical to route through a Secure Web Proxy (SWP) for inspection while allowing all other virtual machines to egress directly to the internet. What should you do?

  • ADeploy a Cloud NAT gateway configured to translate and forward traffic from production-critical VMs to the internet.
  • BConfigure a custom static route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP address as a next hop. (correct answer)
  • CConfigure a policy-based route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP as a next hop.
  • DConfigure a policy-based route with a source set as the subnets of the production-critical VMs and a destination of 0.0.0.0/0 with the SWP IP as the next hop.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure a custom static route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP address as a next hop.

PCNE Question 253

Single page →
Topic 1 · Question 253

You manage your company's network security and have noticed unusual outbound traffic from a Compute Engine VM that is part of a production subnet. You suspect the VM may be compromised, because it is attempting to communicate with a malicious external IP address. You want to capture detailed metadata for every IP connection to and from this specific VM. including source/destination IP, port, protocol, and the amount of data transferred. What should you do?

  • A• Enable VPC Flow Logs on the subnet containing the VM.• Set the sampling rate to 1.0 for maximum detail, and filter the logs in Cloud Logging for the VM's IP address. (correct answer)
  • B• Navigate to Network Intelligence Center, and run a new connectivity test for the VM.• Analyze the report to see which configurations are allowing the traffic.
  • C• Use Packet Mirroring to create a real-time copy of all network packets from the suspected VM.• Forward the copies to a collector VM for analysis.
  • D• Create a new egress firewall rule with a priority of 65535 that allows all outbound traffic.• Enable Firewall Rules Logging on this new rule to capture all connection details.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: • Enable VPC Flow Logs on the subnet containing the VM.• Set the sampling rate to 1.0 for maximum detail, and filter the logs in Cloud Logging for the VM's IP address.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources. Cloud Logging centralizes, stores, and analyzes logs across services.

PCNE Question 254

Single page →
Topic 1 · Question 254

Your organization has two applications running in separate Google Cloud VPC networks (vpc-a and vpc-b) in different projects. You need to establish a secure, private, and encrypted connection between these two VPCs to allow for inter-VPC communication. You must ensure the solution provides high availability and uses dynamic routing. What should you do?

  • AConfigure VPC Network Peering between the two networks, and adjust firewall rules on both sides to allow the required traffic flow between specific subnets. (correct answer)
  • BIn vpc-a, deploy an internal Application Load Balancer for your application. Use Private Service Connect to publish this service in vpc-a and create a PSC consumer endpoint in vpc-b.
  • CIn each VPdeploy a Classic VPN gateway and use a pre-shared key for authentication. Configure static routes to direct traffic to the other VPC.
  • DIn each VPC. deploy an HA VPN gateway and a Cloud Router. Create two VPN tunnels on each gateway, and configure BGP sessions for dynamic routing.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure VPC Network Peering between the two networks, and adjust firewall rules on both sides to allow the required traffic flow between specific subnets.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCNE Question 255

Single page →
Topic 1 · Question 255

You are managing a containerized application environment on Google Kubernetes Engine (GKE). You deployed a microservice with a Kubernetes service manifest that defines a named port, http-api, for its main endpoint. You are now configuring an external http(s) load balancer to expose this microservice. You need to ensure the configuration is independent of the actual port number and follows best practices. What should you do?

  • ACreate a backend service that uses the GKE node instance group as its backend, and configure the named port http-api in the backend service.
  • BReference the GCE_VM_IP_PORT network endpoint group (NEG) in the backend configuration that was automatically created for your Kubernetes service, and specify http-api named port for traffic. (correct answer)
  • CAdd an annotation to your Kubernetes service manifest to create a GCE_VM_IP network endpoint group (NEG), and configure the backend service to use this NEG.
  • DAdd an annotation in your Kubernetes ingress manifest to specify the http-api port number directly, and configure the backend service to use this hardcoded port number.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Reference the GCE_VM_IP_PORT network endpoint group (NEG) in the backend configuration that was automatically created for your Kubernetes service, and specify http-api named port for traffic.

PCNE Question 256

Single page →
Topic 1 · Question 256

You are designing a highly resilient and secure connection between an on-premises data center and Google Cloud for a financial services company. The company requires 10 Gbps of bandwidth and mandates that all traffic be encrypted end-to-end between their on-premises network and their Google Cloud VPC. You have already provisioned two 10 Gbps Dedicated Interconnect connections. You need to determine an encryption strategy that meets these requirements and provides redundancy. What should you do?

  • ADeploy four HA VPN gateways on each Dedicated Interconnect connection. (correct answer)
  • BDeploy two HA VPN gateways on each Dedicated Interconnect connection.
  • CConfigure MACsec on each of the Dedicated Interconnect connections.
  • DUse one Dedicated Interconnect for traffic and an HA VPN over the internet for backup.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy four HA VPN gateways on each Dedicated Interconnect connection.

Explanation

Dedicated Interconnect provides a private physical connection into Google's network. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Showing questions 241–255 of 255 · Page 13 of 13