Online Access Free Professional-Cloud-Network-Engineer Exam Questions

Your company's logo is published as an image file across multiple websites that are hosted by your company. You have implemented Cloud CDN; however, you want to improve the performance of the cache hit ratio associated with this image file. What should you do?

• A.Configure versioned URLs for each domain to serve users the image file before the cache entry expires.
• B.Configure the default time to live (TTL) as 0 for the image file.
• C.Configure Cloud Storage as a custom origin backend to host the image file, and select multi- region as the location type.
• D.Configure custom cache keys for the backend service that holds the image file, and clear the Host and Protocol checkboxes.

You are managing a hybrid cloud environment connecting your on-premises data center to a Google Cloud VPC via Cloud VPN. Your on-premises DNS servers are authoritative for the corp.example.com zone, and a Cloud DNS private zone is authoritative for the gcp.example.com zone. You need to configure a Google-recommended solution that allows Google Cloud VMs to resolve on-premises hostnames and. conversely, allows on-premises hosts to resolve hostnames in your Google Cloud VPC. What should you do?

• A.Create a Cloud DNS forwarding zone for corp.example.com that points to your on-premises DNS servers.Configure a private Cloud DNS zone for gcp.example.com. Create a Cloud DNS inbound server policy, and configure on-premises DNS servers to forward queries for gcp.example.com to it.
• B.Deploy a Compute Engine VM in the VPC to run a DNS forwarder, such as BIND or Unbound.
  Configure this VM to handle bi-directional forwarding between the on-premises DNS servers and Cloud DNS.
• C.Create a Cloud DNS outbound server policy that forwards all DNS queries from the VPC to your on-premises DNS servers.
  Configure your on-premises servers to handle resolution for gcp.example.com and public domains on behalf of the VPC.
• D.Configure your on-premises DNS servers to use Google Cloud's public DNS (8.8.8.8) for all queries.
  Update your Google Cloud instances to use Cloud DNS for internal resolution.

Your company runs its applications on Google Kubernetes Engine (GKE), and your team recently created a private Cloud DNS zone, corp.internal, to host records for internal services, such as a managed database at db.corp.internal. You verified that a Compute Engine VM in the same VPC as your GKE cluster can successfully resolve db.corp.internal. However, when you access a Pod inside your GKE cluster, you can resolve in-cluster services (for example, kubernetes.default.svc.cluster.local), but any attempt to resolve db.corp.internal fails.
Upon inspecting the coredns ConfigMap in the kube-system namespace, you discovered the default forward plugin has been modified to point directly to a public DNS provider's IP address, bypassing the node's local resolver. You need to enable Pods in the cluster to resolve records in the existing corp.internal private zone as well as other zones under .internal.

• A.Modify the coredns ConfigMap in the kube-system namespace, and add corp.internal to a stubDomains entry that points to the VPC's DNS resolver.
• B.Create a Kubernetes service and endpoint of type ExternalName for db.corp.internal.
• C.Enable Cloud DNS for GKE for the GKE cluster.
• D.Modify the coredns ConfigMap in the kube-system namespace. In the Corefile configuration, change the forward plugin to point to /etc/resolv.conf.

Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?

• A.Use Cloud NGFW Essentials. Create a firewall rule for egress traffic, and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
• B.Configure a TLS agent on every VM to intercept TLS traffic before it reaches the internet.
  Configure Sensitive Data Protection to analyze and allow/deny the content.
• C.Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
• D.Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the --tls-inspect flag, and associate the firewall rules with the VMs.

You are designing a new network infrastructure for your customer in Google Cloud. Your customer requires a connection between two Google Cloud VPCs that must include a VPN tunnel. You want to follow Google-recommended practices while ensuring maximum availability of the connection. Which VPN configuration should you choose?

• A.Route-based VPN using Classic VPN between the two Google Cloud VPCs
• B.Border Gateway Protocol (BGP)-based VPN using Classic VPN between the two Google Cloud VPCs
• C.Border Gateway Protocol (BGP)-based VPN using HA VPN between the two Google Cloud VPCs
• D.Policy-based VPN using Classic VPN between the two Google Cloud VPCs