Google GCP-PCNE Certification Exam Sample Questions

GCP-PCNE Braindumps, GCP-PCNE Exam Dumps, GCP-PCNE Examcollection, GCP-PCNE Questions PDF, GCP-PCNE Sample Questions, Professional Cloud Network Engineer Dumps, Professional Cloud Network Engineer Official Cert Guide PDF, Professional Cloud Network Engineer VCEWe have prepared Google Professional Cloud Network Engineer (GCP-PCNE) certification sample questions to make you aware of actual exam properties. This sample question set provides you with information about the Professional Cloud Network Engineer exam pattern, question formate, a difficulty level of questions and time required to answer each question. To get familiar with Google Cloud Platform - Professional Cloud Network Engineer (GCP-PCNE) exam, we suggest you try our Sample Google GCP-PCNE Certification Practice Exam in simulated Google certification exam environment.

To test your knowledge and understanding of concepts with real-time scenario based Google GCP-PCNE questions, we strongly recommend you to prepare and practice with Premium Google Professional Cloud Network Engineer Certification Practice Exam. The premium Google Professional Cloud Network Engineer certification practice exam helps you identify topics in which you are well prepared and topics in which you may need further training to achieving great score in actual Google Cloud Platform - Professional Cloud Network Engineer (GCP-PCNE) exam.

Google GCP-PCNE Sample Questions:

01. An audit requires that your public HTTPS service negotiate only modern TLS versions and cipher suites. The service terminates TLS on a global external Application Load Balancer. You must apply the requirement at the load balancer, and you must be able to apply the identical setting to several other load balancers in the same project.
What should you configure?
a) A Cloud Armor security policy rule that denies requests negotiated below the required TLS version
b) A self managed certificate issued with a modern signature algorithm, replacing the current certificate
c) A backend service setting that requires the connection to the backends to use the required TLS version
d) An SSL policy with a minimum TLS version and restricted profile, attached to each target proxy
 
02. Four teams each own a Google Cloud project and will run their own GKE clusters. Your network team must keep every cluster on one Shared VPC network so that routing, firewall policy and hybrid connectivity are managed centrally, and must be able to see and control the address ranges each cluster consumes.
Which two design decisions support this?
(Choose two.)
a) Build routes-based clusters in each team project so that Pod addresses are carried by custom routes
b) Create the Pod and Service secondary ranges in the host project subnets and assign specific ranges to each cluster
c) Create one VPC network in each team project and peer them with the host project network
d) Attach each team project to the Shared VPC as a service project and build VPC-native clusters on the shared subnets
e) Grant each team the compute network admin role on the host project so they can create their own Pod and Service ranges in the shared subnets
 
03. Two outages in the past year were caused by a self managed certificate on a load balancer expiring unnoticed. Your organization must keep issuing these certificates from its internal authority for some services, so it cannot move every service to a Google managed certificate.
What is the most effective control?
a) Monitor the remaining validity of each certificate and alert well before expiry, alongside a documented rotation procedure
b) Replace the load balancer certificates with Google managed certificates for every service
c) Attach a second certificate to each target proxy so a serving certificate is always present
d) Shorten the validity period of each certificate so that rotations happen more often and lapses are caught
 
04. Your organization blocks a set of address ranges belonging to a scraping service. The same set must be blocked by Cloud Armor policies protecting eleven different applications, and the set changes every few weeks. Editing eleven policies each time has already caused two of them to fall out of step.
What should you do?
a) Write the ranges directly into a deny rule in each policy and update them with a scripted change
b) Consolidate the eleven applications behind one backend service protected by a single policy
c) Apply a hierarchical firewall policy at the organization node denying the ranges
d) Define the set once as a named address list referenced by each policy
 
05. Cloud CDN was enabled in front of a static asset service, but origin traffic has barely fallen. The assets themselves are unchanged and are served over the same load balancer as before. You must determine why so few responses are being served from cache before making further changes.
What should you examine first?
a) The backend service capacity scaler and the maximum utilization setting
b) The Cloud CDN cache invalidation history for the asset paths, and how often the deployment pipeline issues an invalidation across them
c) The cache status recorded in the load balancer request logs, and the response headers the origin returns
d) The health check results for the origin backends
 
06. Instances with internal addresses only in one subnet cannot call Google Cloud APIs, while identical instances in a neighboring subnet in the same VPC succeed. The workload uses the private virtual address range for Google APIs. You must identify every configuration element that could produce this difference between the two subnets.
Which three should you verify?
(Choose three.)
a) Whether the failing instances have been assigned external addresses that would bypass the private path to Google APIs
b) Whether DNS resolution returns the private virtual address for the Google API hostnames on the failing instances
c) Whether Private Google Access is enabled on the failing subnet
d) Whether a route to the Google API address range exists and is usable from the failing subnet
e) Whether the failing subnet is in a different region from the working subnet, since the Google API path is established per region
 
07. Workloads run in four service projects on one Shared VPC network. An application in one service project must address a VM in another by name. The platform team wants a naming scheme that does not require them to publish records manually every time a VM is created or replaced.
What should you rely on?
a) A private Cloud DNS zone in the host project, holding an address record for every instance across the four service projects and their zones
b) Compute Engine internal DNS, which resolves an instance by a name that includes its project and zone across the shared network
c) A private Cloud DNS zone in each service project, made visible to the shared network
d) A DNS peering zone in each service project that forwards queries to the host project
 
08. After a new Dedicated Interconnect was brought into service, small requests between on-premises hosts and Compute Engine instances succeed and connections establish normally, but any transfer that carries a large payload stalls and eventually times out. Routing and firewall rules have been reviewed and are correct in both directions.
What is the most likely cause?
a) The BGP session is flapping, so routes are withdrawn part way through each transfer
b) The VLAN attachment capacity is saturated, so packets are dropped once a transfer begins
c) A firewall rule denies the ports the large transfers use while permitting the ports used for small requests
d) The maximum transmission unit differs along the path and the messages that would signal it are being filtered
 
09. VPC Flow Logs are enabled at full sampling on every subnet, and the logging bill has become the largest line in the network budget. The security team still needs to be able to establish which internal hosts communicated with an external address during an investigation, but does not need every packet accounted for.
Which adjustment best balances the two concerns?
a) Disable flow logs and enable them only when an investigation begins
b) Keep full sampling and shorten the log retention period in the logging bucket, accepting a shorter investigation window
c) Reduce the VPC Flow Logs sample rate and lengthen the aggregation interval, keeping them enabled on the subnets that matter
d) Replace flow logs with Firewall Rules Logging on every rule in the network
 
10. One backend in a group intermittently returns server errors for a subset of requests while continuing to pass its health check, because the check exercises a path that is unaffected. Users see sporadic failures. The team wants failing backends taken out of rotation automatically as the condition appears, without changing the health check.
What should you configure on the backend service?
a) Outlier detection, so a backend returning errors at an unusual rate is ejected from the pool for a period
b) A shorter health check interval with a lower unhealthy threshold on the group
c) Connection draining on the backend service with a short timeout
d) A lower capacity scaler on the affected backend group

Answers:

Question: 01
Answer: d		 Question: 02
Answer: b, d		 Question: 03
Answer: a		 Question: 04
Answer: d		 Question: 05
Answer: c
Question: 06
Answer: b, c, d		 Question: 07
Answer: b		 Question: 08
Answer: d		 Question: 09
Answer: c		 Question: 10
Answer: a

Note: Please update us by writing an email on feedback@vmexam.com for any error in Google Cloud Platform - Professional Cloud Network Engineer (GCP-PCNE) certification exam sample questions

Rating: 5 / 5 (100 votes)