Question 1

You recently deployed two network virtual appliances in us-central1. Your network appliances provide connectivity to your on-premises network, 10.0.0.0/8. You need to configure the routing for your Virtual Private Cloud (VPC). Your design must meet the following requirements: All access to your on-premises network must go through the network virtual appliances. Allow on-premises access in the event of a single network virtual appliance failure. Both network virtual appliances must be used simultaneously. Which method should you use to accomplish this?

Options :

A : Configure two routes for 10.0.0.0/8 with different priorities, each pointing to separate network virtual appliances.

B : Configure an internal HTTP(S) load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal HTTP(S) load balancer as the next hop.

C : Configure a network load balancer for the two network virtual appliances. Configure a route for 10.0.0.0 /8 with the network load balancer as the next hop.

D : Configure an internal TCP/UDP load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal load balancer as the next hop.

Answer: B

Question 2

Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two encrypted VLAN attachments that have a 5 Gbps capacity and a BGP configuration. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?

Options :

A : Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Configure the HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels. Use the same encrypted Cloud Router used for the Cloud Interconnect tier.

B : Enable MACsec for Cloud Interconnect on the VLAN attachments.

C : Enable MACsec on Partner Interconnect.

D : Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Create a new dedicated HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels.

Answer: A

Question 3

Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?

Options :

A : Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.

B : Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the tls-inspect flag and associate the firewall rules with the VMs.

C : Configure a TLS agent on every VM to intercept TLS traffic before it reaches the internet. Configure Sensitive Data Protection to analyze and allow/deny the content.

D : Use Cloud NGFW Essentials. Create a firewall rule for egress traffic and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.

Answer: B

Question 4

You are configuring load balancing for a standard three-tier (web, application, and database) application. You have configured an external HTTP(S) load balancer for the web servers. You need to configure load balancing for the application tier of servers. What should you do?

Options :

A : Configure a forwarding rule on the existing load balancer for the application tier.

B : Configure equal cost multi-path routing on the application servers.

C : Configure a new internal HTTP(S) load balancer for the application tier.

D : Configure a URL map on the existing load balancer to route traffic to the application tier.

Answer: A

Question 5

You just finished your company’s migration to Google Cloud and configured an architecture with 3 Virtual Private Cloud (VPC) networks: one for Sales, one for Finance, and one for Engineering. Every VPC contains over 100 Compute Engine instances, and now developers using instances in the Sales VPC and the Finance VPC require private connectivity between each other. You need to allow communication between Sales and Finance without compromising performance or security. What should you do?

Options :

A : Configure an HA VPN gateway between the Finance VPC and the Sales VPC.

B : Configure the instances that require communication between each other with an external IP address.

C : Create a VPC Network Peering connection between the Finance VPC and the Sales VPC.

D : Configure Cloud NAT and a Cloud Router in the Sales and Finance VPCs.

Answer: C

Free Professional-Cloud-Network-Engineer Mock Exam – Practice Online Confidently

Buying Options: