Question 1

You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the on-premises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel. Which filter should you use in Cloud Logging to examine the logs?

Options :

A : resource.type= “gce_router”

B : resource.type= “gce_network_region”

C : resource.type= “vpn_tunnel”

D : resource.type= “vpn_gateway”

Answer: C

Question 2

You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy. Which GKE resource should you use?

Options :

A : GKE Node

B : GKE Pod

C : GKE Cluster

D : GKE Ingress

Answer: D

Question 3

Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute instances that run these applications have an associated secure tag. What should you do?

Options :

A : Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.

B : Deploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.

C : Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.

D : Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.

Answer: B

Question 4

Your organization wants to set up hybrid connectivity with VLAN attachments that terminate in a single Cloud Router with 99.9% uptime. You need to create a network design for your on-premises router that meets those requirements and has an active/passive configuration that uses only one VLAN attachment at a time. What should you do?

Options :

A : Create a design that uses a BGP multi-exit discriminator (MED) attribute to influence the egress path from Google Cloud to the on-premises environment.

B : Create a design that uses the as_path BGP attribute to influence the egress path from Google Cloud to the on-premises environment.

C : Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on-premises devices.

D : Create a design that uses the local_pref BGP attribute to influence the egress path from Google Cloud to the on-premises environment.

Answer: A

Question 5

You have provisioned a Partner Interconnect connection to extend connectivity from your on-premises data center to Google Cloud. You need to configure a Cloud Router and create a VLAN attachment to connect to resources inside your VPC. You need to configure an Autonomous System number (ASN) to use with the associated Cloud Router and create the VLAN attachment. What should you do?

Options :

A : Use a 4-byte private ASN 4200000000-4294967294.

B : Use a 2-byte private ASN 64512-65535.

C : Use a public Google ASN 15169.

D : Use a public Google ASN 16550.

Answer: B

Confidently Practice Online with Free Professional-Cloud-Network-Engineer Exam Cram

Buying Options: