Professional-Cloud-Network-Engineer Practice Test

You have enabled HTTP(S) load balancing for your application, and your application
developers have reported that HTTP(S) requests are not being distributed correctly to your
Compute Engine Virtual Machine instances. You want to find data about how the request
are being distributed. Which two methods can accomplish this? (Choose two.)

A.

On the Load Balancer details page of the GCP Console, click on the Monitoring tab,
select your backend service, and look at the graphs.

B.

In Stackdriver Error Reporting, look for any unacknowledged errors for the Cloud Load
Balancers service.

C.

In Stackdriver Monitoring, select Resources > Metrics Explorer and search for
https/request_bytes_count metric.

D.

In Stackdriver Monitoring, select Resources > Google Cloud Load Balancers and review
the Key Metrics graphs in the dashboard.

E.

In Stackdriver Monitoring, create a new dashboard and track the
https/backend_request_count metric for the load balancer.

You just finished your company’s migration to Google Cloud and configured an architecture
with 3 Virtual Private Cloud (VPC) networks: one for Sales, one for Finance, and one for
Engineering. Every VPC contains over 100 Compute Engine instances, and now
developers using instances in the Sales VPC and the Finance VPC require private
connectivity between each other. You need to allow communication between Sales and
Finance without compromising performance or security. What should you do?

A.

Configure an HA VPN gateway between the Finance VPC and the Sales VPC.

B.

Configure the instances that require communication between each other with an
external IP address.

C.

Create a VPC Network Peering connection between the Finance VPC and the Sales
VPC.

D.

Configure Cloud NAT and a Cloud Router in the Sales and Finance VPCs.

You are using the gcloud command line tool to create a new custom role in a project by
coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?

A.

Add the resourcemanager.projects.get permission, and try again

B.

Try again with a different role with a new name but the same permissions

C.

Remove the resourcemanager.projects.list permission, and try again.

D.

Add the resourcemanager.projects.setIamPolicy permission, and try again

You are configuring a new application that will be exposed behind an external load
balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443.
You will have backends in two regions: us-west1 and us-east1. You want to serve the
content with the lowest possible latency while ensuring high availability and autoscaling.
Which configuration should you use?

A.

Use global SSL Proxy Load Balancing with backends in both regions.

B.

Use global TCP Proxy Load Balancing with backends in both regions

C.

Use global external HTTP(S) Load Balancing with backends in both regions.

D.

Use Network Load Balancing in both regions, and use DNS-based load balancing to
direct traffic to the closest region.

In your Google Cloud organization, you have two folders: Dev and Prod. You want a
scalable and consistent way to enforce the following firewall rules for all virtual machines
(VMs) with minimal cost:
Port 8080 should always be open for VMs in the projects in the Dev folder.
Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder.
What should you do?

A.

Create and associate a firewall policy with the Dev folder with a rule to open port 8080.
Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.

B.

Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects.
Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall
rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared
VPCs.

C.

In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all
VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.

D.

Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev
VMs and deny traffic to port 8080 on the Prod VMs.