Online Access Free Google.Professional-Cloud-Network-Engineer.v2024-02-05.q70 Practice Test (Page 15)

Professional-Cloud-Network-Engineer Exam Question 66

You recently configured Google Cloud Armor security policies to manage traffic to your application. You discover that Google Cloud Armor is incorrectly blocking some traffic to your application. You need to identity the web application firewall (WAF) rule that is incorrectly blocking traffic. What should you do?

A.Enable VPC Flow Logs, and view the logs in Cloud Logging.

B.Enable Google Cloud Armor audit logs, and view the logs on the Activity page in the Google Cloud Console.

C.Enable firewall logs, and view the logs in Firewall Insights.

D.Enable HTTP(S) Load Balancing logging with sampling rate equal to 1, and view the logs in Cloud Logging.

Professional-Cloud-Network-Engineer Exam Question 67

You need to define an address plan for a future new Google Kubernetes Engine (GKE) cluster in your Virtual Private Cloud (VPC). This will be a VPC-native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses. Which subnet mask should you use for the Pod IP address range?

A./21

B./23

C./22

D./25

Professional-Cloud-Network-Engineer Exam Question 68

You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload.
Which type of load balancer should you use?

A.HTTP(S) load balancer

B.Network load balancer

C.Internal load balancer

D.TCP/SSL proxy load balancer

Professional-Cloud-Network-Engineer Exam Question 69

You successfully provisioned a single Dedicated Interconnect. The physical connection is at a colocation facility closest to us-west2. Seventy-five percent of your workloads are in us-east4, and the remaining twenty-five percent of your workloads are in us-central1. All workloads have the same network traffic profile. You need to minimize data transfer costs when deploying VLAN attachments. What should you do?

A.Keep the existing Dedicated Interconnect. Deploy a VLAN attachment to a Cloud Router in us-east4, and deploy another VLAN attachment to a Cloud Router in us-central1.

B.Order a new Dedicated Interconnect for a colocation facility closest to us-east4, and use VPC global routing to access workloads in us-central1.

C.Keep the existing Dedicated interconnect. Deploy a VLAN attachment to a Cloud Router in us-west2, and use VPC global routing to access workloads in us-east4 and us-central1.

D.Order a new Dedicated Interconnect for a colocation facility closest to us-central1, and use VPC global routing to access workloads in us-east4.

Professional-Cloud-Network-Engineer Exam Question 70

You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space In your enterprise, you plan to use privately used public IP space for the new clusters. You want to follow Google-recommended practices. What should you do after designing your IP scheme?

A.Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters

B.Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters Re-use the secondary address range for the services across multiple private GKE clusters

C.Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected and

D.Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster With the following options selected --disable-default-snat, -enable-ip-alias, and-enable-private-nodes

Correct Answer: D

This answer follows the Google-recommended practices for using privately used public IP (PUPI) addresses for GKE Pod address blocks1. The benefits of this approach are:
It allows you to use any public IP addresses that are not owned by Google or your organization for your Pods, which can help mitigate address exhaustion in your enterprise.
It prevents any external traffic from reaching your Pods, as Google Cloud does not route PUPI addresses to the internet or to other VPC networks by default.
It enables you to use VPC Network Peering to connect your GKE cluster to other VPC networks that use different PUPI addresses, as long as you enable the export and import of custom routes for the peering connection.
It preserves the fully integrated network model of GKE, where Pods can communicate with nodes and other resources in the same VPC network without NAT.
The options that you need to select when creating a private GKE cluster with PUPI addresses are:
-disable-default-snat: This option disables source NAT for outbound traffic from Pods to destinations outside the cluster's VPC network. This is necessary to prevent Pods from using RFC 1918 addresses as their source IP addresses, which could cause conflicts with other networks that use the same address space2.
-enable-ip-alias: This option enables alias IP ranges for Pods and Services, which allows you to use separate subnet ranges for them. This is required to use PUPI addresses for Pods1.
-enable-private-nodes: This option creates a private cluster, where nodes do not have external IP addresses and can only communicate with the control plane through a private endpoint. This enhances the security and privacy of your cluster3.
Option A is incorrect because it does not use PUPI addresses for Pods, but rather RFC 1918 addresses. This does not solve the problem of address exhaustion in your enterprise. Option B is incorrect because it reuses the secondary address range for Services across multiple private GKE clusters, which could cause IP conflicts and routing issues. Option C is incorrect because it does not specify the options that are needed to create a private GKE cluster with PUPI addresses.
1: Configuring privately used public IPs for GKE | Kubernetes Engine | Google Cloud 2: Using Cloud NAT with GKE | Kubernetes Engine | Google Cloud 3: Private clusters | Kubernetes Engine | Google Cloud

Other Version: 377Google.Professional-Cloud-Network-Engineer.v2026-02-01.q106; 984Google.Professional-Cloud-Network-Engineer.v2024-12-11.q112; 874Google.Professional-Cloud-Network-Engineer.v2024-05-06.q121; 1446Google.Professional-Cloud-Network-Engineer.v2022-09-17.q73; 2037Google.Professional-Cloud-Network-Engineer.v2022-05-31.q72; 124Google.Passexamdumps.Professional-Cloud-Network-Engineer.v2022-02-28.by.stanford.72q.pdf; 1787Google.Professional-Cloud-Network-Engineer.v2022-02-17.q85; 107Google.Examcollectionpass.Professional-Cloud-Network-Engineer.v2021-08-08.by.dempsey.84q.pdf

Latest Upload: 126VMware.3V0-21.25.v2026-06-20.q29; 134Microsoft.AB-731.v2026-06-19.q23; 271IIA.IIA-CIA-Part2.v2026-06-19.q308; 163DAMA.MD-1220.v2026-06-19.q66; 160ISTQB.CT-AI.v2026-06-18.q68; 252IIA.IIA-CIA-Part3.v2026-06-17.q220; 172WGU.Introduction-to-IT.v2026-06-17.q67; 251CompTIA.220-1202.v2026-06-16.q110; 146TheInstitutes.CPCU-500.v2026-06-16.q25; 234ACAMS.CAMS7-CN.v2026-06-16.q170

Professional-Cloud-Network-Engineer Exam Question 66

Professional-Cloud-Network-Engineer Exam Question 67

Professional-Cloud-Network-Engineer Exam Question 68

Professional-Cloud-Network-Engineer Exam Question 69

Professional-Cloud-Network-Engineer Exam Question 70

Download PDF File