Google Professional Cloud Network Engineer Exam Practice Questions (P. 5)
- Full Access (237 questions)
- Six months of Premium Access
- Access to one million comments
- Seamless ChatGPT Integration
- Ability to download PDF files
- Anki Flashcard files for revision
- No Captcha & No AdSense
- Advanced Exam Configuration
Question #21
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
What should you do?
- ADouble the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- BCreate two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- CAdd a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
- DAdd a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
Correct Answer:
C
C
GPT-4o - Answer
To effectively scale your Cloud VPN for higher throughput, the best practice is to deploy a second on-premises VPN gateway with a distinct public IP. Then, establish an additional VPN tunnel from your existing Cloud VPN gateway to this new gateway. This setup doesn't just provide redundancy but also enhances overall bandwidth capabilities by leveraging multiple tunnels concurrently, each routed through separate gateways. This approach is supported by Google's recommended VPN topologies for achieving higher throughput and load balancing. Ensure both gateways and tunnels are correctly configured to handle the specified IP ranges for seamless connectivity and optimal performance.
Question #23
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
"¢ Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
"¢ The subnetwork logs are not excluded from Stackdriver.
"¢ The instance that is hosting the application can communicate outside the subnet.
"¢ Other instances within the subnet can communicate outside the subnet.
"¢ The external resource initiates communication.
What is the most likely cause of the missing log lines?
During troubleshooting you find:
"¢ Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
"¢ The subnetwork logs are not excluded from Stackdriver.
"¢ The instance that is hosting the application can communicate outside the subnet.
"¢ Other instances within the subnet can communicate outside the subnet.
"¢ The external resource initiates communication.
What is the most likely cause of the missing log lines?
- AThe traffic is matching the expected ingress rule.
- BThe traffic is matching the expected egress rule.
- CThe traffic is not matching the expected ingress rule.
- DThe traffic is not matching the expected egress rule.
Correct Answer:
C
C
GPT-4o - Answer
The correct analysis indicates that the traffic from the external resource is indeed incoming (ingress), which means it tries to match on ingress rules in your firewall settings. When no appropriate allow rule matches this incoming traffic, it is blocked by the default implicit deny rule, which by design does not log such traffic. This scenario leads to a lack of logged entries as observed because standard ingress deny rules, including implicit deny, do not initiate log captures for blocked traffic in Google Cloud environments. It's important to ensure correct ingress rules are explicitly defined for all intended communications.
All Pages